// Detect It Easy: detection rule file
// Author: KDSS-Research

// https://happy-hack.net/pentest/10639-oxi-joiner-by-vazonez.html
meta("joiner", "OxiJoiner");

function detect() {
    var rsrcSection = PE.section[".rsrc"];

    if (PE.compareEP("e85c000000a30b3040006a00e868000000a313304000e86a000000a3703c40006a0aff350b3040006a00ff3513304000e8eaf4ffff6a00e813000000ccff257c204000ff2508204000ff250c204000ff") &&
        rsrcSection && PE.findString(rsrcSection.FileOffset, rsrcSection.FileSize, "PAPADDING") !== -1) {
        bDetected = true;
    }

    return result();
}