Learning to Look Benign: Targeted Evasion of Malware Detectors via API Import Injection