// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://unprotect.it/technique/exestealth/
meta("protector", "ExeStealth");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........B97B0900008BF7AC")) {
        sVersion = "1.1";
        bDetected = true;
    } else if (PE.compareEP("6090EB22'ExeStealth'")) {
        sVersion = "2.5";
        bDetected = true;
    } else if (PE.compareEP("EB0060EB00E8000000005D81ED")) {
        sVersion = "2.70-2.71";
        bDetected = true;
    } else if (PE.compareEP("EB00EB2F'Shareware - ExeStealth'00")) {
        sVersion = "2.72-2.73";
        sOptions = "Shareware";
        bDetected = true;
    } else if (PE.compareEP("EB00EB17'Shareware - ExeStealth'00")) {
        sVersion = "2.74";
        sOptions = "Shareware";
        bDetected = true;
    } else if (PE.compareEP("906090E8000000005D81ED........B915000000")) {
        sVersion = "2.75";
        bDetected = true;
    } else if (PE.compareEP("EB58'Shareware-Version ExeStealth'")) {
        sVersion = "2.75a";
        sOptions = "Shareware";
        bDetected = true;
    } else if (PE.compareEP("EB..'ExeStealth V2 Shareware '")) {
        sVersion = "2.76";
        sOptions = "Shareware";
        bDetected = true;
    } else if (PE.compareEP("EB65'ExeStealth V2 - www'")) {
        sVersion = "2.76";
        bDetected = true;
    }

    var tnResource = PE.resource["TN"];
    if (!bDetected && tnResource) {
        if (PE.compare("'MZ'", tnResource.FileOffset) || PE.isSectionNamePresent("ExeS")) {
            bDetected = true;
        }
    }

    return result();
}
