// Detect It Easy: detection rule file
// Author: Yosef Khaled

// https://github.com/0xballistics/inject2pe
meta("tool", "inject2pe");

function detect() {
    if (!PE.is64() && PE.getDosStubSize() === 0 &&
        PE.section[0].Characteristics === 0xE0000020 &&
        PE.calculateSizeOfHeaders() === 0x200 &&
        PE.getNumberOfSections() === 1 &&
        PE.getNumberOfImports() === 0 &&
        !PE.isConsole()) {
        bDetected = true;

        if (PE.section[0].Name !== ".inj") {
            sOptions = "modified";
        }
    }

    return result();
}