// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/frkngksl/Huan
meta("cryptor", "Huan");

function detect() {
    if (PE.is64() && // The author plans to add 32-bit support; As of May 3, 2026, only 64-bit is supported.
        PE.getNumberOfImports() === 1 &&
        PE.compareEP("4883EC28E8........4883C428E9........CCCC40534883EC..488BD933C9FF15........488BCBFF15........FF15........488BC8BA........4883C4..5B48FF25........48894C24..") &&
        PE.getImportFunctionName(0, 0) === "VirtualAlloc" &&
        PE.getImportFunctionName(0, 1) === "LoadLibraryA") {
        bDetected = true;

        if (PE.section[PE.getNumberOfSections() - 1].Name !== ".huan") {
            sOptions = "modified";
        }
    }

    return result();
}