← All detection heuristics · Shellcode
high
SC_STR_LOADLIBRARY
What it means
String 'LoadLibrary' (or LoadLibraryA/W/Ex) found in file bytes.
Why it fires
LoadLibrary maps a DLL into the current process and returns its base address; combined with GetProcAddress it is the standard primitive for shellcode to resolve Win32 API functions without using the import table. Documents do not normally embed this string in their data.
Other Shellcode heuristics
SC_STR_CREATEREMOTETHREAD SC_MSF_BIND SC_MSF_REVERSE SC_MSF_C2 SC_STR_URLDOWNLOAD SC_STR_WRITEPROCESSMEMORY SC_XOR_ENCODED SC_STR_CREATEPROCESS SC_EGG_HUNTER SC_STR_GETPROCADDRESS SC_HEAP_SPRAY SC_API_HASH_RESOLVER SC_PEB_ACCESS_X64 SC_PEB_ACCESS SC_STR_POWERSHELL SC_STR_SHELLEXEC SC_STR_WINEXEC SC_STR_WSCRIPT SC_XOR_DECODER SC_XOR_DECODED_NETWORK_CONFIG SC_STR_BITSADMIN SC_STR_CERTUTIL SC_STR_CMD SC_STR_MSHTA