Runtime hashing is an obfuscation technique where a program does not store API or function names in plain text. Instead, it keeps a hash value for each target name and computes hashes during execution until it finds the matching exported function. Malware uses this to hide obvious strings and avoid a normal import table, making static analysis harder.
This matters in cyber security because it reduces what scanners and analysts can learn from a file before it runs. In real attacks, runtime hashing is often used to resolve Windows APIs for file access, process control, networking, or injection without leaving readable function names in the binary. Defenders look for the behavior behind it: unusual loops over export tables, dynamic library loading, memory strings that appear only briefly, and API calls discovered only at runtime. Emulation, sandboxing, and behavioral monitoring can expose these lookups even when static signatures cannot.