// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx", "GZip");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83....5356578965")) {
        for (var i = 0; i < PE.resource.length && !bDetected; i++) {
            if (PE.compare("1f8b08", PE.resource[i].Offset)) {
                bDetected = true;
            }
        }
    } else if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("1f8b08")) {
            bDetected = true;
        }
    }

    return result();
}