mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
5819fc9bdb
Renamed and reorganized numerous rule files in db/PE and db/MSDOS to use consistent prefixes (e.g., compiler_, installer_, packer_, etc.) and moved some files to db_extra. Also deleted the obsolete IBM_VisualAge_PL_I.6.sg file. This improves maintainability and clarity of the rule database.
20 lines
No EOL
569 B
JavaScript
20 lines
No EOL
569 B
JavaScript
// Detect It Easy: detection rule file
|
|
// Author: hypn0 <hypn0@mail.ru>
|
|
|
|
meta("packer", "HTML Executable");
|
|
|
|
function detect() {
|
|
if (PE.compareEP("558bec83c4..b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3")) {
|
|
if (PE.compareOverlay("'GHE32'")) {
|
|
bDetected = true;
|
|
}
|
|
} else if (PE.compareEP("558becb9........6a..6a..4975..535657b8........e8$$$$$$$$538bd833c0a3........6a..e8........a3")) {
|
|
if (PE.compareOverlay("'HEEG'")) {
|
|
bDetected = true;
|
|
}
|
|
}
|
|
|
|
sLang = "HTML";
|
|
|
|
return result();
|
|
} |