// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/EgeBalci/amber
meta("cryptor", "Amber");

function detect() {
    if (PE.isImportPositionHashPresent(-1, 0x97c72051) &&
        PE.compareEP(PE.is64() ?
            "48 83 EC .. 48 8B 05 .. .. .. .. C7 00 .. .. .. .. E8 .. .. .. .. E8 .. .. .. .. 90 90 48 83 C4" : // 64 bit
            "83 EC 0C C7 05 94 53 40 00 01 00 00 00 E8 9E 02 00 00 83 C4 0C E9 A6 FC FF FF 8D B6 00 00 00 00 83 EC 0C C7 05 94 53 40 00 00 00 00 00 E8 7E 02 00 00 83 C4 0C E9 86 FC FF FF 8D B6 00 00 00 00 83 EC 1C 8B 44 24 20 89 04 24 E8 1D 12 00 00 85 C0 0F 94 C0 83 C4 1C 0F B6 C0 F7 D8 C3 90 90 90 55 89 E5 83")) { // 32 bit
        bDetected = true;
    }

    return result();
}