// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("archive", "Microsoft Compound");

function detect() {
    if (Binary.compare("D0CF11E0A1B11AE1")) {
        const // magic values
            nSub1 = Binary.readWord(0x200),
            nSub2 = Binary.readWord(0x1000);

        if (nSub1 == 0 && nSub2 == 0xFFFD) {
            sType = "installer";
            sName = "Microsoft Installer (MSI)";
        } else if (nSub1 == 0xA5EC) {
            sType = "format";
            sName = "Microsoft Office";
            sVersion = "1997-2003";
        } else {
            sVersion = "Office, 1997-2003";
        }

        bDetected = true;
    }

    return result();
}
