Detect-It-Easy/db/PE/protector_Babel_.NET.2.sg

// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Babel .NET");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetObjectPresent("BabelObfuscatorAttribute")) {
            sVersion = "1.0-2.X";
            bDetected = true;
        } else if (PE.isNetObjectPresent("BabelAttribute")) {
            sVersion = "3.X";
            bDetected = true;
        }

        // fake signatures
        if (bDetected &&
            PE.isNetObjectPresent("BabelAttribute") &&
            PE.isNetObjectPresent("BabelObfuscatorAttribute")) {
            bDetected = false;
        }
    }

    return result();
}