// Detect It Easy: detection rule file format
// Author: hypn0 <hypn0@mail.ru>

init("installer", "Ghost Installer");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.compareEP("60be........8dbe........c787................5783cd..eb")) {
        if (PE.compareOverlay("c0dececb8d8d8d8d")) {
            sOptions = "xored MSCF, mask: 8D";
            sVersion = "1.0.0.0";
            bDetected = true;
        }
    }

    return result(bShowType, bShowVersion, bShowOptions);
}