// Detect It Easy: detection rule file format
// Author: hypn0 <hypn0@mail.ru>

init("sfx", "Active Delivery");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec605356578965..ff15")) {
        if (PE.section["actdlvry"]) {
            if (PE.compare("'AD01'", PE.section["actdlvry"].FileOffset)) {
                bDetected = true;
            }
        }
    }

    return result(bShowType, bShowVersion, bShowOptions);
}