mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
23 lines
No EOL
684 B
JavaScript
23 lines
No EOL
684 B
JavaScript
// Detect It Easy: detection rule file
|
|
// Author: hypn0 <hypn0@mail.ru>
|
|
|
|
meta("protector", "VBox");
|
|
|
|
function detect() {
|
|
if (PE.compareEP("ff7424..ff7424..ff7424..68........68........68........68........ff15")) {
|
|
if (PE.isLibraryPresent("vboxp410.dll")) {
|
|
sVersion = "4.10";
|
|
bDetected = true;
|
|
} else if (PE.isLibraryPresent("vboxp403.dll")) {
|
|
sVersion = "4.03";
|
|
bDetected = true;
|
|
}
|
|
}
|
|
|
|
if (PE.findSignature(PE.getEntryPointOffset(), 0x1000, "558bec83c4..5657be........8b45..8946..ff75..8f46..8b45..8946..56") !== -1) {
|
|
sVersion = "4.20";
|
|
bDetected = true;
|
|
}
|
|
|
|
return result();
|
|
} |