// Detect It Easy: detection rule file
// Author: KDSS-Research

meta("cryptor", "LimeCrypter");

function detect() {
    if (PE.isNet()) {
        bDetected = true;
        if (validateReferences(
            isPositive = true,
            references = [
                "System.Security.Cryptography",
                "System.Collections.Generic",
                "System.Resources",
                "System.Reflection"
            ]
        )) {
            bDetected = false;
            return; // end
        }

        if (!PE.isSignatureInSectionPresent(0, "3c50726976617465496d706c656d656e746174696f6e44657461696c733e7b........................................................................7d") ||
            !PE.isSignatureInSectionPresent(0, "24........................................................................") ||
            !PE.isNetObjectPresent("<Initialize>o__SiteContainer0") ||
            !PE.isNetObjectPresent("$$method0x6000005-1") ||
            !PE.isNetObjectPresent("Assembly") ||
            !PE.isNetObjectPresent("Rfc2898DeriveBytes") ||
            !PE.isNetObjectPresent("AES_Decrypt") ||
            !PE.isNetObjectPresent("<>p__Site1") || PE.isNetObjectPresent("Chainski")) {
            bDetected = false;
        }
    }

    return result();
}


// validateReferences by DosX
function validateReferences(isPositive, references) {
    for (var i = 0; i < references.length; i++) {
        var sign = "00'" + references[i] + "'00";
        if (isPositive == true) {
            if (!PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        } else { // negative
            if (PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        }
    }
    return false;
}