###### Abstract
Behaviour-based methods can detect both known and unknown malware but require high computational resources [9]. To address these limitations, researchers have developed specification-based techniques, which leverage behaviour-based approaches. Data mining and ML techniques have been successfully applied, achieving high accuracy in malware detection and classification [10; 11; 12]. These methods, particularly effective for metamorphic malware, focus on behavioural features rather than structural ones [13; 14]. API call sequences, offering valuable insights into malware behaviour, have been widely utilised by researchers [15; 16; 17; 18]. The ability to classify malware based on API call behaviour enables faster attribution and a better understanding of the malware's impact. This knowledge empowers administrators to devise appropriate mitigation strategies. Despite the existing approaches that utilize Windows PE executable files for feature extraction and employ ML algorithms for malware detection, there is a lack of comprehensive research investigating the correlation between feature extraction and scoring techniques for API calls and their impact on the accuracy and efficiency of various ML algorithms in malware detection. Hence, this paper aims to answer the following three research questions:  
**RQ1:** How does the extracting the frequency of API calls from Windows PE files contribute to the detection and classification of malware (Section 4.3)? **RQ2:** What are the most influential features identified by the feature extraction and scoring methods in distinguishing between malware and goodware (Section 4.4)? **RQ3:** How does the performance of state-of-the-art (SOTA) ML algorithms vary in terms of accuracy and efficiency for malware detection when trained on the extracted features from Windows PE files (Section 4.5)? By considering these research questions, the research contributions of this paper are as follows:  
**Malware analysis:** Dynamic analysis of malware samples within a controlled Cuckoo Sandbox environment, which yielded critical insights into malware behaviour (Section 3.1.2). **Dataset generation:** Curation of a new dataset consisting of API calls of both malware and goodware derived from Windows PE files (Section 3.1.3). **Malware classification:** Classification of malware families by leveraging the Virustotal API for accurate labelling (Section 4.2). **API categorisation:** Detailed categorisation of APIs used within each PE file (Section 4.3). **Feature scoring:** Identification of APIs that contribute to malicious activities utilising feature scoring methods (Section 4.4). **Performance evaluation:** A comprehensive performance analysis of ML models based on performance metrics (Section 4.5). **Comparative analysis:** A comparative analysis highlighting the distinguishing features of our approach compared to existing research in the field (Section 5). The remainder of the paper is organised in the following sections: Section 2 provides an overview of the related work in the field. Section 3 presents the methodology employed in our research. Section 4, presents and discusses the results obtained from the classification algorithms used. Section 5 presents a comprehensive comparative analysis, highlighting the unique aspects of our work compared to existing studies. Section 6, focuses on the limitations of the research, as well as outlining future research directions, particularly focusing on addressing the highlighted shortcomings. The paper concludes with Section 7, where a summary of the key findings and contributions of the research is presented.