Detect-It-Easy/db/PE/Windows_Authenticode.7.sg

// Detect It Easy: detection rule file

init("sign tool", "Windows Authenticode");

function detect() {
    if (PE.compareOverlay("........00020200")) {
        sVersion = "2.0";
        sOptions = "PKCS #7";
        bDetected = true;
    }

    return result();
}