Detect-It-Easy/db/COM/COM-Protection.2.sg

// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

init("protector", "COM-Protection");

function detect() {
    if (Binary.compare("e9$$$$eb$$86c08ec086dbeb$$05....87db8b2e....97eb$$aaaaeb$$aaaaeb$$bb....03ddb9....03cd87cbb8")) {
        sOptions = "by JAM //UCF";
        bDetected = true;
    }

    return result();
}