// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Astrum");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        if (PE.isOverlayPresent() != -1) {
            for (var i = 0; i < PE.getNumberOfResources(); i++) {
                if (PE.resource[i].Type == 77) {
                    if (PE.findSignature(PE.resource[i].Offset, 0x140, "'AstrumInstallWizard'") != -1) {
                        bDetected = true;
                        break;
                    }
                }
            }
        }
    }

    return result();
}