Detect-It-Easy/db/COM/NoAV.2.sg

// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

init("protector", "NoAV");

function detect() {
    if (Binary.compare("e9$$$$68....60be....66b8........668706....b9....51c1e9..41be....5156bf....e8")) {
        sOptions = "by VAG";
        bDetected = true;
    }

    return result();
}