Detect-It-Easy/db_extra/PE/BasicCrypt1.1.sg

// Detect It Easy: detection rule file

init("cryptor", "BasicCrypt");

function detect() {
    if (PE.compareEP("68b0114000e88bfbffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4010000641b400000000000308c4000408c4000980b000000904000b41040")) {
        sOptions = "sudo";
        bDetected = true;
    }

    return result();
}