Detect-It-Easy/db/PE/protector_HackShield.2.sg

// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "HackShield");

function detect() {
    var impSection = PE.section[PE.getImportSection()];
    if (impSection) {
        var nOffset = impSection.FileOffset,
            nSize = impSection.FileSize;

        nSize = Math.min(nSize, 0x2048);
        if (PE.findString(nOffset, nSize, "TerminateHackShield") != -1) {
            bDetected = true;
        }
    }

    return result();
}