← All detection heuristics · Shellcode
high
SC_API_HASH_RESOLVER
What it means
PEB access combined with nearby ROR13-style API hashing.
Why it fires
Windows shellcode often walks the PEB to find loaded DLLs, then hashes export names to resolve APIs without storing cleartext imports. ROR13 hash loops are a common resolver primitive; seeing them near PEB access is a strong position-independent shellcode indicator.
Other Shellcode heuristics
SC_STR_CREATEREMOTETHREAD SC_MSF_BIND SC_MSF_REVERSE SC_MSF_C2 SC_STR_URLDOWNLOAD SC_STR_WRITEPROCESSMEMORY SC_XOR_ENCODED SC_STR_CREATEPROCESS SC_EGG_HUNTER SC_STR_GETPROCADDRESS SC_HEAP_SPRAY SC_STR_LOADLIBRARY SC_PEB_ACCESS_X64 SC_PEB_ACCESS SC_STR_POWERSHELL SC_STR_SHELLEXEC SC_STR_WINEXEC SC_STR_WSCRIPT SC_XOR_DECODER SC_XOR_DECODED_NETWORK_CONFIG SC_STR_BITSADMIN SC_STR_CERTUTIL SC_STR_CMD SC_STR_MSHTA