The compiled Visual Basic samples look like standard MZ-PE executables. They can be easily recognized by a unique imported DLL, MSVBVM60.DLL (MSVBVM50.DLL was used for the older version). PEiD is generally very good at identifying this programming language (when the sample is not packed, obviously):
Figure 13: PEiD identifying Visual Basic
At the entry point of the sample, we can expect to see a call to the ThunRTMain (MSVBVM60.100) runtime function:
Figure 14: Entry point of the Visual Basic sample
The Thun here is a reference to the original project's name, BASIC Thunder. This function receives a pointer to the following structure:
| Field | Size | Description |
| VbMagic | 4 | VB5! signature |
| RuntimeBuild | 2 | Runtime build |
| LangDll | 14 | Language DLL |
| SecLanguageDLL | 14 | Alternative language DLL |
| RuntimeRevision | 2 | Version of the runtime |
| LCID | 4 | Code of the application language |
| SecLCID | 4 | Alternative language code |
| SubMain | 4 | Address of the main routine (can be zero) |
