Detect-It-Easy/db/PE/protector_Obfuscator_NET_2009.2.sg

// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Obfuscator.NET 2009");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetUStringPresent("Macrobject.Obfuscator")) {
            bDetected = true;
        } else if (PE.isNetUStringPresent("Obfuscated by Macrobject Obfuscator.NET UNREGISTRED")) {
            sOptions = "Unregistered";
            bDetected = true;
        }
    }

    return result();
}