In more detail
In a Portable Executable (PE) file, the import directory lists each DLL the program needs and, for every DLL, the functions it calls, for example CreateFileW from kernel32.dll. When Windows loads the program, it fills a table of addresses (the import address table) so the code can call those functions. Because the list sits in the file's headers, it shows capabilities without running the file: imports for networking, process injection or registry access hint at behaviour. A very small table can mean the file is packed and resolves imports at run time.
Why it matters
Analysts triage unknown files by their imports before doing anything riskier. A hash of the normalised import list (an "imphash") is used to group related malware builds. But imports are only a clue. Ordinary programs use powerful functions too, and malware can hide its calls by resolving functions by name or hash while running, leaving an almost empty table.
Example
These imports, seen together in one executable, deserve a closer look because they are the classic steps of injecting code into another process:
kernel32.dll!OpenProcess
kernel32.dll!VirtualAllocEx
kernel32.dll!WriteProcessMemory
kernel32.dll!CreateRemoteThread
By contrast, a file that imports only LoadLibraryA and GetProcAddress is typical of a Packer: it loads everything else after unpacking itself. Inspect a file's imports with the Executable Forensics.