mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
dc2a925b3d
Renamed PE rule files to use a consistent naming convention with prefixes indicating their type (e.g., compiler_, packer_, installer_, etc.). Also updated file permissions to 100644 where needed and made minor whitespace-only changes to some files for consistency. This improves maintainability and clarity of the signature database.
34 lines
No EOL
1.1 KiB
JavaScript
34 lines
No EOL
1.1 KiB
JavaScript
// Detect It Easy: detection rule file
|
|
// 25.11.2018 added 5.X Version - A.S.L - asl@onet.eu
|
|
|
|
meta("protector", "Spices.Net");
|
|
|
|
function detect() {
|
|
if (PE.isNet()) {
|
|
if (PE.isNetObjectPresent("NineRays.Obfuscator")) {
|
|
if (PE.isSignaturePresent(PE.section[1].FileOffset - 512, 512, "'Built using an evaluation version of 9Rays.Net Spices.Obfuscator.'")) {
|
|
sOptions = "demo";
|
|
}
|
|
|
|
bDetected = true;
|
|
}
|
|
|
|
if (!bDetected) {
|
|
var spicesSignature = "'9Rays.Net Spices.Net Obfuscator'";
|
|
if (PE.isDll()) {
|
|
if (PE.isSignatureInSectionPresent(1, spicesSignature) || PE.isSignatureInSectionPresent(0, spicesSignature)) {
|
|
sVersion = "5.X";
|
|
sOptions = "DLL";
|
|
bDetected = true;
|
|
}
|
|
}
|
|
} else {
|
|
if (PE.isSignatureInSectionPresent(0, spicesSignature)) {
|
|
sVersion = "5.X";
|
|
bDetected = true;
|
|
}
|
|
}
|
|
}
|
|
|
|
return result();
|
|
} |