// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("data", "");

function detect() {
    if (Binary.isOverlay()) {
        if (Binary.compare("'aWAW'")) {
            sName = "CreateInstall data";
            bDetected = true;
        } else if (Binary.compare("';!@Install@!UTF-8!'")) {
            sName = "7-zip Installer data";
            bDetected = true;
        } else if (Binary.compare("00'TMSAMVOH'")) {
            sName = "ActiveMark protector data";
            bDetected = true;
        } else if (Binary.compare("....................'MSCF'00")) {
            sName = "Actual Installer data";
            bDetected = true;
        } else if (Binary.compare("'10JP'")) {
            sName = "Adveractive Installer data";
            bDetected = true;
        } else if (Binary.compare("'EWETAR DATA FILE!! VER 1.00 <<<>>>'")) {
            sName = "Aeco Systems installer data";
            bDetected = true;
        } else if (Binary.compare("c0ab........60ea")) {
            sName = "ARJSFX32 data";
            bDetected = true;
        } else if (Binary.compare("67570402")) {
            sName = "ARQ archive";
            bDetected = true;
        } else if (Binary.compare("0b0bafaf0b0ba4")) {
            sName = "AutoPlay Media Studio installer data";
            bDetected = true;
        } else if (Binary.compare("'wwgT)'") || Binary.compare("..120100....0000")) {
            sName = "ClickTeam installer data";
            bDetected = true;
        } else if (Binary.compare("'CK16'")) {
            sName = "CrypKey Installer archive";
            bDetected = true;
        } else if (Binary.compare("........'DIMDMSCF'")) {
            sName = "Dimd SFX data";
            sOptions = "CAB";
            bDetected = true;
        } else if (Binary.compare("'[metadata]'")) {
            sName = "distutils installer data";
            bDetected = true;
        } else if (Binary.compare("b297e169")) {
            sName = "Envoy Packager data";
            bDetected = true;
        } else if (Binary.compare("'EPSF'")) {
            sName = "Eschalon Installer archive";
            bDetected = true;
        } else if (Binary.compare("........'SPIS'1a'LH5'")) {
            sName = "GPInstall data";
            sOptions = "SPIS LH5";
            bDetected = true;
        } else if (Binary.compare("'zlb'1A") || Binary.compare("'idska32'1A")) {
            sName = "Inno Setup Installer data";
            bDetected = true;
        } else if (Binary.compare("'Inno Setup Messages'")) {
            sName = "Inno Setup uninstall data";
            bDetected = true;
        } else if (Binary.compare("'1CNT'")) {
            sName = "LucasArts Update Installer data";
            bDetected = true;
        } else if (Binary.compare("'MPU'0d")) {
            sName = "MP-ZipTool SFX32 data";
            bDetected = true;
        } else if (Binary.compare("'MPQ'1a20")) {
            sName = "MPQ archive";
            bDetected = true;
        } else if (Binary.compare("'PK??NOS_PO'") || Binary.compare("'NOS_PO'")) {
            sName = "NOS Installer data";
            bDetected = true;
        } else if (Binary.compare("970300000201")) {
            sName = "Pantaray QSetup data";
            sVersion = "10.X";
            bDetected = true;
        } else if (Binary.compare("370700000201")) {
            sName = "Pantaray QSetup data";
            sVersion = "11.X";
            bDetected = true;
        } else if (Binary.compare("04'PBG'")) {
            sName = "Paquet archive";
            sVersion = "1.5";
            bDetected = true;
        } else if (Binary.compare("'GSfx'")) {
            sName = "Paquet archive";
            sVersion = "1.0";
            bDetected = true;
        } else if (Binary.compare("'PB'................................'7z'")) {
            sName = "Paquet Builder";
            sOptions = "7zip";
            bDetected = true;
        } else if (Binary.compare("'qres'")) {
            sName = "QT installer data";
            bDetected = true;
        } else if (Binary.compare("4B2A9A") || Binary.compare("4B2A84")) {
            sName = "RTPatch archive";
            bDetected = true;
        } else if (Binary.compare("e0e0e1e1e2e2e3e3e4e4e5e5e6e6e7e7")) {
            sName = "Setup Factory installer data";
            sVersion = "8.X, 9.X";
            bDetected = true;
        } else if (Binary.compare("e0e1e2e3e4e5e6")) {
            sName = "Setup Factory installer data";
            sVersion = "4.X, 5.X";
            bDetected = true;
        } else if (Binary.compare("67155234ff4d3642")) {
            sName = "STATICSUP installer data";
            bDetected = true;
        } else if (Binary.compare("'ESIV'") || Binary.compare("'SIVM'", 0xf000)) {
            sName = "Vise Installer data";
            bDetected = true;
        } else if (Binary.compare("'RsDl'")) {
            sName = "WinImage SFX data";
            bDetected = true;
        } else if (Binary.compare("'IMP'0a")) {
            sName = "IMP archive";
            bDetected = true;
        } else if (Binary.compare("'@Daisy@Lucy@xyzzy@'................1f8b08")) {
            sName = "WinPatch Apply Program data";
            sOptions = "gzip";
            bDetected = true;
        } else if (Binary.compare("'@Daisy@Lucy@xyzzy@'1f8b08")) {
            sName = "WinPatch Apply Program data";
            sOptions = "gzip";
            bDetected = true;
        } else if (Binary.compare("'***messages***'")) {
            sName = "WinRAR Installer data";
            bDetected = true;
        } else if (Binary.compare("fffe2a002a002a006d0065007300730061006700650073002a002a002a00")) {
            sName = "WinRAR Installer data";
            sVersion = "5.X";
            bDetected = true;
        }
        /* else if(Binary.compare("'Rar!'"))
        {
            sName="RAR archive";
            bDetected=1;
        } */
        else if (Binary.compare("'MPV*'")) {
            sName = "ZipCentral SFX-32 data";
            bDetected = true;
        } else if (Binary.compare("'[20/20]'")) {
            sName = "PCInstall data";
            bDetected = true;
        } else if (Binary.compare("'ISSetupStream'")) {
            sName = "InstallShield data";
            sVersion = "18.X";
            bDetected = true;
        } else if (Binary.compare("'FWS'") || Binary.compare("'CWS'")) {
            sName = "Adobe Flash";
            bDetected = true;
        } else if (Binary.compare("'Smart Install Maker v'")) {
            sName = "Smart Install Maker data";
            sVersion = Binary.getString(Binary.getOverlayOffset() + 0x17);
            bDetected = true;
        } else if (Binary.compare("....0000dcedbd")) {
            sName = "PackageForTheWeb data";
            sOptions = "InstallShield";
            bDetected = true;
        } else if (Binary.compare("'00000000000000BD00000000000000010000000000000001'", 0x19a0)) {
            sName = "Autodesk Self-Extract data";
            bDetected = true;
        } else if (Binary.compare("c0dececb8d8d8d8d")) {
            sName = "Ghost Installer archive";
            sOptions = "xored MSCF, mask: 8D";
            bDetected = true;
        } else if (Binary.compare("02060a0405fd59")) {
            sName = "CreateInstall data";
            sVersion = "2003.3.5";
            bDetected = true;
        } else if (Binary.compare("'RWMV'")) {
            sName = "VMWare Installation Launcher data";
            bDetected = true;
        } else if (Binary.compare("........'GRCSETUPINFORMATION'")) {
            sName = "Codegear Installer data";
            bDetected = true;
        } else if (Binary.compare("'xvm'0003")) {
            sName = "Spoon Studio data";
            bDetected = true;
        } else if (Binary.compare("2f30ee1f5e4ee51e")) {
            sName = "Advanced Installer data";
            sOptions = "MS Compound-like format";
            bDetected = true;
        } else if (Binary.compare("'^OPT'")) {
            var ArcOffset = Binary.findString(Binary.getOverlayOffset(), 0x50, "^ARC");
            if (ArcOffset != -1) {
                if (Binary.compare("1f8b08", ArcOffset + 4)) {
                    sName = "Adobe SVG Installer";
                    sOptions = "gzip";
                    bDetected = true;
                }
            }
        } else if (Binary.compare("07d26cbf2159abaa0100000000")) {
            sName = "Chilkat ZIP Self-Extractor data";
            bDetected = true;
        } else if (Binary.compare("'IST'00")) {
            sName = "Dolphin Virtual Machine data";
            sVersion = "5.0";
            bDetected = true;
        } else if (Binary.compare("'@._P-DATA_.@'")) {
            sName = "CodeFusion Wizard data";
            bDetected = true;
        } else if (Binary.compare("'ASWsetupFPkgFil3'")) {
            sName = "avast! Antivirus installer data";
            bDetected = true;
        } else if (Binary.compare("5b3e")) {
            var ArcOffset = Binary.findSignature(Binary.getOverlayOffset(), 0x500, "'PK'0304");
            if (ArcOffset != -1) {
                sName = "InstallAnywhere data";
                sOptions = "zip";
                bDetected = true;
            }
        } else if (Binary.compare("........efbeadde'NullsoftInst'")) {
            sName = "NSIS data";
            bDetected = true;
        } else if (Binary.compare("................fec1cd666ebccf01fec1cd666ebccf0100..............78da")) {
            sName = "Internet Download Manager installer data";
            sOptions = "zlib";
            bDetected = true;
        } else if (Binary.compare("d513e4e801000000")) {
            sName = "Install4j installer data";
            bDetected = true;
        } else if (Binary.compare("efbbbf';!@Install@!UTF-8!'")) {
            sName = "7-zip Installer data";
            bDetected = true;
        } else if (Binary.compare("'UM'030a00")) {
            sName = "Sony Windows installer data";
            bDetected = true;
        } else if (Binary.compare("7b00320030003700320036003300370037002d00")) {
            sName = "ADS Self Extractor data";
            bDetected = true;
        } else if (Binary.findSignature(Binary.getOverlayOffset(), Math.min(0x100, Binary.getOverlaySize()), "7b00320030003700320036003300370037002d00") != -1) {
            sName = "ADS Self Extractor data";
            bDetected = true;
        } else if (Binary.compare("276327631226097513180178")) {
            sName = "Chaos Software installer data";
            bDetected = true;
        } else if (Binary.compare("'OWS9G1'", 0xb)) {
            sName = "Gentee installer data";
            bDetected = true;
        } else if (Binary.compare("'SQ5SFX'")) {
            sName = "Squeez SFX data";
            bDetected = true;
        } else if (Binary.compare("'Inno Setup Setup Data'")) {
            sName = "Inno Setup data";
            bDetected = true;
        } else if (Binary.findSignature(Binary.getOverlayOffset(), Math.min(0x100, Binary.getOverlaySize()), "'MSCF00000000'") != -1) {
            sName = "CAB archive";
            bDetected = true;
        } else if (Binary.findSignature(Binary.getOverlayOffset(), Math.min(0x100, Binary.getOverlaySize()), "'ISc('") != -1) {
            sName = "InstallShield archive";
            bDetected = true;
        } else if (Binary.compare("'ExcelsiorII1'")) {
            sName = "Excelsior installer data";
            bDetected = true;
        } else if (Binary.compare("'InstallShield'00")) {
            sName = "InstallShield data";
            sOptions = "2.X-3.X";
            bDetected = true;
        } else if (Binary.compare("'wwwwI'874712")) {
            sName = "Multimedia Fusion installer data";
            bDetected = true;
        } else if (Binary.compare("'PIMPFILE'00")) {
            sName = "PIMP installer data";
            bDetected = true;
        } else if (Binary.compare("'tiz1'........78da")) {
            sName = "Tarma installer data";
            sOptions = "zlib";
            bDetected = true;
        } else if (Binary.compare("'XXataDfOnigeB'")) {
            sName = "I-D Media installer data";
            bDetected = true;
        } else if (Binary.compare("'This is the end of the executable'")) {
            sName = "SwiftView installer data";
            bDetected = true;
        } else if (Binary.compare("1f8b08", 0x3000)) {
            sName = "BulletProofSoft installer data";
            sOptions = "gzip";
            bDetected = true;
        } else if (Binary.compare("'AddD'03")) {
            sName = "SecuROM data";
            var nOffset = Binary.getOverlayOffset();
            sVersion = Binary.getString(nOffset + 8);
            bDetected = true;
        } else if (Binary.compare("'NB02'")) {
            sName = "CodeView 3.14 debug information";
            bDetected = true;
        } else if (Binary.compare("'NB09'")) {
            sName = "CodeView 4.10 debug information";
            bDetected = true;
        } else if (Binary.compare("'NB11'")) {
            sName = "CodeView 5.0 debug information";
            bDetected = true;
        } else if (Binary.compare("'NB10'")) {
            sName = "PDB 2.0 file link";
            bDetected = true;
        } else if (Binary.compare("'RSDS'")) {
            sName = "PDB 7.0 file link";
            bDetected = true;
        } else if (Binary.compare("'[(*|*)]MZ'")) {
            sName = "Mioplanet installer executable+data"
            bDetected = true;
        } else if (Binary.compare("'MPV'")) {
            sName = "DelZip SFX data";
            bDetected = true;
        } else if (Binary.compare("'MPU'00")) {
            sName = "CoffeeCup SFX data";
            bDetected = true;
        } else if (Binary.compare("'<KRZIP FILE BEGINS HERE>'")) {
            sName = "KRZIP archive";
            bDetected = true;
        } else if (Binary.compare("..........87000001........5d0000800000")) {
            sName = "Smart Install Maker data";
            bDetected = true;
        } else if (Binary.compare("'RS'")) {
            sName = "AOLSetup data";
            bDetected = true;
        } else if (Binary.compare("'TGCF'")) {
            sName = "Setup-Specialist archive";
            bDetected = true;
        } else if (Binary.compare("a3484bbe986c4aa9")) {
            sName = "AutoIt compiled script";
            sVersion = "2.XX-3.XX";
            bDetected = true;
        } else if (Binary.compare("'MSCF'00000000")) {
            sName = "CAB archive";
            bDetected = true;
        } else if (Binary.compare("'PK'0304")) {
            sName = "ZIP archive";
            bDetected = true;
        } else if (Binary.compare("'$_BIM_CONFIG_START_$")) {
            sName = "Bytessence Install Maker data";
            bDetected = true;
        } else if (Binary.compare("........'.eh_frame'00")) {
            sName = "BitRock installer data";
            bDetected = true;
        } else if (Binary.compare("09050000")) {
            sName = "ThinApp data";
            bDetected = true;
        } else if (Binary.compare("BDA6EEE9F9EDEFEDE5ED")) {
            sName = "Hamrick Software XOR-ed ZIP";
            bDetected = true;
        } else if (Binary.compare("000000000000000038e8020000000000")) {
            sName = "Box Stub installer data";
            bDetected = true;
        } else if (Binary.compare("a7870800")) {
            sName = "Install Factory data";
            bDetected = true;
        } else if (Binary.compare("a7870800")) {
            sName = "Install Factory data";
            bDetected = true;
        } else if (Binary.compare("a6d6b210")) {
            sName = "Sax Software archive";
            bDetected = true;
        } else if (Binary.compare("'Win_Sfx_For_Windows_'")) {
            sName = "XZIP-SFX data";
            sOptions = "by Netzip";
            bDetected = true;
        } else if (X.SU16(2, 16) == "[GeneralOptions]") {
            sName = "Advanced Installer data";
            bDetected = true;
        } else if (Binary.compare("d90e0100889f")) {
            sName = "Winlicense xored EXE (0xC5 xor mask)";
            bDetected = true;
        } else if (Binary.compare("000201010002e000400bf00900120002")) {
            sName = "ARDI-SFX data";
            bDetected = true;
        } else if (Binary.compare("7856341278563412")) {
            sName = "Stardust SFX data";
            bDetected = true;
        } else if (Binary.compare("'lsfx'..02")) {
            sName = "EXEpress data";
            bDetected = true;
        } else if (Binary.compare("'JKMNPQSTVWYZ'")) {
            sName = "Jexepack data";
            bDetected = true;
        } else if (Binary.compare("'XXWTInstall'")) {
            sName = "WTInstall data";
            bDetected = true;
        } else if (Binary.compare("00000000ffffffff00000000'BZh'")) {
            sName = "InstallWrap data (BZIP)";
            bDetected = true;
        } else if (Binary.compare("'IS'011a")) {
            sName = "Instyler data (zlib)";
            bDetected = true;
        }

        /* var ArcOffset=Binary.findSignature(Binary.getOverlayOffset(),0x400, "'|http:'");
        if(ArcOffset!=-1)
        {
            sName="Pantaray QSetup data";
            sVersion="6.X";
            bDetected=1;
        }
        var ArcOffset=Binary.findSignature(Binary.getOverlayOffset(),0x400, "'|www.'");
        if(ArcOffset!=-1)
        {
            sName="Pantaray QSetup data";
            sVersion="8.X";
            bDetected=1;
        } */
    }

    return result();
}