// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/DosX-dev/NET-MalwareCryptor
meta("cryptor", "CryptEngine");

function detect() {
    if (PE.isNetObjectPresent("Inject") && PE.isNetUStringPresent("EntryPoint") && PE.isNetUStringPresent("Invoke") && PE.isNetUStringPresent("Load")) {
        sVersion = "NET-MalwareCryptor";
        bDetected = true;
    }

    return result();
}