// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Goliath");

function detect() {
    if (PE.isSectionNamePresent(".GOLIATH")) {
        if (PE.isNetObjectPresent("ObfuscatedByGoliath")) {
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'.Goliath.NET.CodeShield.'")) {
            bDetected = true;
        }
    }

    if (bDetected && PE.isSignatureInSectionPresent(0, "20006500760061006C007500610074006500")) {
        sOptions = "demo";
    }

    return result();
}