Detect-It-Easy/db/COM/Shadow_COM_encryptor.2.sg

// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

init("cryptor", "Shadow COM encryptor");

function detect() {
    if (Binary.compare("e9$$$$b9....bb....be....bf....ad33c3ab86dff7d3e2..68")) {
        sVersion = "1.0";
        sOptions = "by Tailgunner";
        bDetected = true;
    }

    return result();
}