// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/czs108/Windows-PE-Packer
meta("packer", "Windows PE Packer by Chenzs108");

function detect() {
    if (!PE.is64() && !PE.isNet() &&
        PE.getNumberOfSections() > 2 &&
        PE.getNumberOfImports() === 1 &&
        PE.isImportPositionHashPresent(0, 0x1272f45b)) {
        if (PE.compareEP("60E8E10000002E0002000000000000")) {
            var shellSectionByIndex = PE.section[PE.nLastSection];

            if (shellSectionByIndex.Characteristics & 0xe0000040) { // R/W/X
                bDetected = true;

                if (shellSectionByIndex.Name !== ".shell") {
                    sOptions = "modified sections";
                }
                if (PE.getImportLibraryName(0) !== "Kernel32.dll") {
                    sOptions += (sOptions ? " and " : "modified ") + "IAT";
                }
            }
        }

    }

    return result();
}