// Detect It Easy: detection rule file
// Author: r0da https://github.com/whereisr0da
// Edited: DosX

meta("protector", "KoiVM");

function detect() {

    if (PE.isNet() && _getNumberOfResults("protector") <= 1) {
        if (PE.isSignatureInSectionPresent(0, "'KoiVM'") ||
            PE.isSignatureInSectionPresent(0, "'VMEntryRun'")) {
            bDetected = true;
        }

        sVersion = "2.0+";
    }

    return result();
}