// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Rewritten by: DosX

meta("sign tool", "Windows Authenticode");

function detect() {
    if (PE.isSigned()) {
        sVersion = "2.0";
        sOptions = "PKCS #7";
        bDetected = true;

        if (PE.isOverlayPresent() && !PE.compareOverlay("00020200", 0x04)) {
            sOptions = sOptions.append("after overlay");
        }
    }

    return result();
}