// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Crypto Obfuscator");

function detect() {
    if (PE.isNet() && PE.isNetObjectPresent("AssemblyInfoAttribute")) {
        if (PE.isSignatureInSectionPresent(0, "000220....000a20ffffff0028........2a")) {
            sVersion = "5.X";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "0291203fffffff5f1f18620a067e........021758911f1062600a067e")) {
            sVersion = "5.X";
            bDetected = true;
        }
    }

    return result();
}