How hidden? I just tested with
notepad.exe
:
dumpbin %windir%\notepad.exe /imports
Part of output:
File Type: EXECUTABLE IMAGE
Section contains the following imports:
ADVAPI32.dll
10000C000 Import Address Table
10000D1E8 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
7FF7FF21ED0 27E RegSetValueExW
7FF7FF2C2D0 26E RegQueryValueExW
7FF7FF21F00 23C RegCreateKeyW
7FF7FF30710 230 RegCloseKey
7FF7FF306F0 261 RegOpenKeyExW
7FF7FF30720 180 IsTextUnicode
7FF7FF27E04 57 CloseServiceHandle
7FF7FF1C2A8 1F9 OpenSCManagerW
7FF7FF1C2C0 1FB OpenServiceW
7FF7FF1C6FC 224 QueryServiceConfigW
KERNEL32.dll
10000C058 Import Address Table
10000D240 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
78D2CF20 209 GetLocalTime
78D2D3F0 1CF GetDateFormatW
...
...
I don't see anything hidden so far.
—SA