// Rewrited from yara (YARA-Rule by f0wl) by KDSS-Research
//

init("packer","Ezuri");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if (ELF.isSectionNamePresent(".strtab") && ELF.isSectionNamePresent(".gopclntab")&& ELF.isSectionNamePresent(".noptrdata")&& ELF.isSectionNamePresent(".rodata"))
    {
        var nSection=ELF.getSectionNumber(".strtab");
   
        var nSectionOffset=ELF.getSectionFileOffset(nSection);
        var nSectionSize=ELF.getSectionFileSize(nSection);

        var nSection2=ELF.getSectionNumber(".gopclntab");
   
        var nSectionOffset2=ELF.getSectionFileOffset(nSection2);
        var nSectionSize2=ELF.getSectionFileSize(nSection2);

        var nSection3=ELF.getSectionNumber(".noptrdata");
   
        var nSectionOffset3=ELF.getSectionFileOffset(nSection3);
        var nSectionSize3=ELF.getSectionFileSize(nSection3);

        var nSection4=ELF.getSectionNumber(".rodata");
   
        var nSectionOffset4=ELF.getSectionFileOffset(nSection4);
        var nSectionSize4=ELF.getSectionFileSize(nSection4);


        var nOffset=ELF.findString(nSectionOffset,nSectionSize,"main.runFromMemory");
        var n2=ELF.findString(nSectionOffset,nSectionSize,"main.aesDec");
        var n3=ELF.findString(nSectionOffset2,nSectionSize2,"crypto/cipher.NewCFBDecrypter");
        var n4=ELF.findString(nSectionOffset4,nSectionSize4,"/proc/self/fd/%d");
        var n5=ELF.findString(nSectionOffset4,nSectionSize4,"/dev/null");
        var n6=ELF.findSignature(nSectionOffset3,nSectionSize3,"A5 63 63 C6 84 7C 7C F8");
        var n7=ELF.findSignature(nSectionOffset3,nSectionSize3,"63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76");

        if (nOffset!=-1 && n2!=-1  && n3!=-1 && n4!=-1  && n5!=-1 && n6!=-1 && n7!=-1 ){
            bDetected=1;
        }
        
    }
    return result(bShowType,bShowVersion,bShowOptions);
}
