// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "Active Delivery");

function detect() {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec605356578965..ff15") &&
        PE.section["actdlvry"] && PE.compare("'AD01'", PE.section["actdlvry"].FileOffset)) {
        bDetected = true;
    }

    return result();
}