// Detect It Easy: detection rule file // Author: horsicq meta("library", "Java"); function detect() { if (PE.getOverlaySize() > 0x40) { if (PE.findString(PE.getOverlayOffset(), 0x40, "META-INF/MANIFEST.MF") != -1) { var nResSection = PE.getResourceSection(); if (nResSection != -1) { if (PE.isSignatureInSectionPresent(nResSection, "'Java Runtime Environment'")) { bDetected = true; } } } } sLang = "Java"; return result(); }