Detect-It-Easy/db/PE/protector_IntelliProtector.2.sg

// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "IntelliProtector");

function detect() {
    var nLastSectionOffset = PE.section[PE.nLastSection].FileOffset;
    if (PE.compare("E9........CC", nLastSectionOffset)) {
        var nVersionOffset = PE.findString(nLastSectionOffset, PE.section[PE.nLastSection].FileSize, "Protected by IntelliProtector");
        if (nVersionOffset != -1) {
            sVersion = PE.getString(nVersionOffset + 30);
            bDetected = true;
        }
    }

    return result();
}