// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/DosX-dev/Astral-PE
meta("tool", "Astral-PE");

function detect() {
    if (PE.section[0].Name === String() && !PE.isRichSignaturePresent() &&
        PE.getImageFileHeader("TimeDateStamp") === 0 && PE.getImageOptionalHeader("CheckSum") === 0 &&
        PE.getMajorLinkerVersion() === 0 && PE.getMinorLinkerVersion() === 0) {
        if (PE.isLibraryPresentExp(/^(?!.*\.dll$)\.[\\/]/i)) {
            sOptions = "IAT mutation";
            bDetected = true;
        }
    }

    return result();
}