// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "Sixxpack");

function detect() {
    if (PE.isNet() && PE.isNetUStringPresent("Data Error")) {
        if (PE.isSignatureInSectionPresent(0, "00'actmp.dll'00'stub'00'Sixxpack'00")) {
            sVersion = "2.2";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "0021......'xpack!'00................'xpack'00")) {
            sVersion = "2.4";
            bDetected = true;
        } else if (PE.isNetObjectPresent("Sixxpack")) {
            sVersion = "2.X";
            bDetected = true;
        }
    }

    return result();
}