// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.softpedia.com/get/Security/Encrypting/ExeShield.shtml
meta("protector", "ExeShield");

function detect() {
    if (PE.compareEP("E8040000008360EB0C5DEB05") && PE.compareOverlay("85c0") && PE.isRichSignaturePresent() && !PE.getNumberOfImports()) {
        bDetected = true;

        if (!PE.isSectionNamePresent(".shield")) {
            sOptions = "modified";
        }
    }

    return result();
}