Discovering Dynamically Loaded API in Visual Basic Binaries
Summary: Cisco Talos published an analysis of how Visual Basic binaries compiled to Windows PE files route their entry point through ThunRTMain and can dynamically load API functions outside msvbvm60.dll via the DllFunctionCall function. The write-up details the DllFunctionCallStruct and DynamicHandles structures, including a byte at offset 0x0A that determines whether GetProcAddress is called with an export name or ordinal, and offers an IDA Python script that labels these wrapper functions and prints all dynamically loaded APIs.
What you should know: Malware can hide dozens or hundreds of these DllFunctionCall wrappers in a single VB binary, so an analyst who cannot resolve them is working blind on the API calls that matter most.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026