// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// Enhanced by: Yosef Khaled

// https://github.com/Fatmike-GH/Fatpack
meta("packer", "Fatpack");

function detect() {
    if (!PE.isNet() && PE.is64() && PE.isTLSPresent()) {
        if (PE.getNumberOfImports() === 1 && PE.isImportPositionHashPresent(0, 0x74244911)) {
            for (var i = 0; i < PE.getNumberOfSections(); ++i) {
                if (PE.section[i].FileSize === 0) {
                    bDetected = true;
                    break;
                }
            }

            if (PE.getNumberOfResources() > 0) {
                for (var i = 0; i < PE.getNumberOfResources(); ++i) {
                    if (PE.compare("5D00001000", PE.getResourceOffsetByNumber(i))) {
                        sOptions = "resources payload";
                        if (PE.getResourceNameByNumber(i) !== "FPACK") {
                            sOptions = sOptions.append("modified");
                        }
                        break;
                    }
                }
            }

            if (!sOptions) {
                sOptions = "section payload";
                if (PE.section[PE.nLastSection].Name !== ".fpack  ") {
                    sOptions = sOptions.append("modified");
                }
            }
        }
    }

    return result();
}