die-python 0.4.0__cp313-abi3-win_amd64.whl

db/PE/Microsoft_C_Runtime.4.sg

@@ -0,0 +1,16 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "Microsoft C/C++ Runtime");
+
+function detect() {
+    if (PE.isLibraryPresent("vcruntime140.dll") ||
+        PE.isLibraryPresent("vcruntime140_1.dll")) {
+        bDetected = true;
+        sOptions = "dynamic";
+    }
+
+    return result();
+}

db/PE/Microsoft_Class_Installer.1.sg

@@ -0,0 +1,22 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "Microsoft Class Installer for Java");
+
+function detect() {
+    if (PE.compareEP("64A1........558BEC6A..68........68........50648925........83EC..5356578965..FF15")) {
+        for (var i = 0; i < PE.resource.length; i++) {
+            if (PE.resource[i].Type == 280) //ZIP
+            {
+                if (PE.compare("'PK'0304", PE.resource[i].Offset)) {
+                    sVersion = "4.x";
+                    sOptions = "zip";
+                    bDetected = true;
+                    break;
+                }
+            }
+        }
+    }
+
+    return result();
+}

db/PE/Microsoft_Compound-based_installer.1.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "Microsoft Compound-based installer (MSI)");
+
+function detect() {
+    if (PE.compareEP("558becb9........6a..6a..4975..51535657b8........e8........33c05568........64ff3064892033c05568")) {
+        if (PE.compareOverlay("d0cf11e0a1b11ae1")) {
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/Microsoft_Edge_WebView.4.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "Microsoft Edge WebView");
+
+function detect() {
+    if (PE.isLibraryPresent("WebView2Loader.dll") || PE.isLibraryPresent("msedge_elf.dll")) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/Microsoft_NET_Runtime.4.sg

@@ -0,0 +1,15 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", ".NET Core runtime");
+
+function detect() {
+    if (PE.isLibraryPresent("coreclr.dll")) {
+        bDetected = true;
+        sVersion = "5.XX+";
+    }
+
+    return result();
+}

db/PE/Microsoft_Warbird.2.sg

@@ -0,0 +1,15 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("protection", "Microsoft Warbird");
+
+function detect() {
+    bDetected = PE.section["?g_Encry"] && PE.isFunctionPresent("NtQuerySystemInformation");
+
+    if (bDetected && PE.findSignature(0, PE.getSize() - PE.getOverlaySize(), "'?g_EncryptedSegmentSystemCall_"))
+        sOptions = "VM";
+
+    return result();
+}

db/PE/Microsoft_dotNET_installer.1.sg

@@ -0,0 +1,16 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "Microsoft dotNET installer");
+
+function detect() {
+    if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374")) {
+        var ArcOffset = PE.findSignature(PE.getOverlayOffset(), Math.min(0x110, PE.getOverlaySize()), "'7z'bcaf");
+        if (ArcOffset != -1) {
+            sOptions = "7zip";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/Miktex_Installer.1.sg

@@ -0,0 +1,15 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "MiKTeX Installer");
+
+function detect() {
+    if (PE.compareEP("e9$$$$$$$$4883ec..e8$$$$$$$$e9$$$$$$$$48895c24..55488bec4883ec..488b05........48bb................483bc375..488365")) {
+        if (PE.compareOverlay("'TARTARTARTARTART'")) {
+            sOptions = "tar";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/MinGW.4.sg

@@ -0,0 +1,78 @@
+// Detect It Easy: detection rule file
+
+init("compiler", "MinGW");
+
+includeScript("FPC");
+
+function getMinGWVersion() {
+    var sResult = "";
+
+    var rdataSection = PE.section[".rdata"];
+
+    if (rdataSection) {
+        var nOffset = rdataSection.FileOffset,
+            nSize = rdataSection.FileSize,
+            nVersionOffset = PE.findString(nOffset, nSize, "GCC: ");
+
+        if (nVersionOffset != -1) {
+            sResult = PE.getString(nVersionOffset, 128);
+        }
+
+        if (sResult == "") {
+            var nVersionOffset = PE.findString(nOffset, nSize, "gcc-");
+            if (nVersionOffset != -1) {
+                sResult = PE.getString(nVersionOffset);
+                sResult = sResult.substring(0, sResult.indexOf('/'));
+            }
+        }
+    }
+
+    return sResult;
+}
+
+function detect() {
+    /*if(PE.compareEP("5589E583EC08C7042401000000FF15........E8C8FEFFFF908DB426000000005589E583EC08C7042402000000FF15"))
+    {
+        bDetected=1;
+    }
+    else if(PE.compareEP("5589E583EC0883C4F46A..A1........FFD0E8..FFFFFF"))
+    {
+        bDetected=1;
+    }
+    else if(PE.compareEP("5589E583EC146A..FF15....................................00000000"))
+    {
+        bDetected=1;
+    }
+    else */
+
+    if (PE.getMajorLinkerVersion() == 2) {
+        if (!bFPC && (PE.getMinorLinkerVersion() <= 30 || PE.getMinorLinkerVersion() == 36 || PE.getMinorLinkerVersion() == 56)) {
+            if (PE.compare("'MZ'90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21'This program cannot be run in DOS mode.\r\r\n$'0000000000000'PE'0000")) {
+                if (!PE.section[".rsrc"]) {
+                    bDetected = true;
+                } else {
+                    var nOffset = PE.section[".rsrc"].FileOffset;
+                    var nSize = PE.section[".rsrc"].VirtualSize;
+                    if (!PE.isSignaturePresent(nOffset + nSize - 512, 512, "'Microsoft Corp.'")) {
+                        bDetected = true;
+                    }
+                }
+            }
+        }
+    }
+
+    if (bDetected) {
+        sVersion = getMinGWVersion();
+    } else {
+        var buildidSection = PE.section[".buildid"],
+            rdataSection = PE.section[".rdata"];
+
+        if (buildidSection && rdataSection) {
+            bDetected = PE.isSignaturePresent(rdataSection.FileOffset, rdataSection.FileSize, "'Mingw'");
+        }
+    }
+
+    _setLang("C/C++", bDetected);
+
+    return result();
+}

db/PE/Minke.2.sg

@@ -0,0 +1,12 @@
+// Detect It Easy: detection rule file
+
+init("protector", "Minke");
+
+function detect() {
+    if (PE.compareEP("558BEC83C4F053..........10E87AF6FFFFBE........33C05568........64FF30648920E8FAF8FFFFBA")) {
+        sVersion = "1.0.1";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/Mioplanet_installer.1.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "Mioplanet installer");
+
+function detect() {
+    if (PE.compareEP("eb$$a1........c1e0..a3........526a..e8........8bd0e8........5ae8")) {
+        if (PE.compareOverlay("'[(*|*)]MZ'")) {
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/MoleBox.2.sg

@@ -0,0 +1,41 @@
+// Detect It Easy: detection rule file
+
+init("packer", "MoleBox");
+
+function detect() {
+    if (PE.compareEP("e80000000060e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15")) {
+        sVersion = "2.3.3-2.6.4";
+        bDetected = true;
+    } else if (PE.compareEP("e80000000060e8$$$$$$$$e8$$$$$$$$8b4424..508b4424..50e8$$$$$$$$558bec83ec..5356576a..ff15")) {
+        sVersion = "2.3.3-2.6.4";
+        bDetected = true;
+    } else if (PE.compareEP("60e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15")) {
+        sVersion = "2.0.0-2.3.0";
+        bDetected = true;
+    } else if (PE.compareEP("eb$$b8........8338..74..50ff70..ff3050830424..e8$$$$$$$$558beca1........53568b75..85c0578bde75..6a..68........68........ff15")) {
+        sVersion = "2.36";
+        bDetected = true;
+    }
+    /* else if(PE.compareEP("6A2868........E8$$$$$$$$68........64A100000000508B442410896C24108D6C24102BE05356578B45F88965E8"))
+     {
+         sVersion="4.XX";
+         bDetected=1;
+     }*/
+    /* else if(PE.compareEP("5589E583EC08C7042401000000FF15........E8B8FEFFFF908DB426000000005589E583EC08C7042402000000FF15"))
+    {
+        if(PE.isOverlayPresent()&&(PE.section.length>=6))
+        {
+            var nNumbersOfImports=PE.getNumberOfImports();
+            if((nNumbersOfImports==4)||(nNumbersOfImports==3))
+            {
+                if(PE.isLibraryPresent("KERNEL32.dll")&&PE.isLibraryPresent("msvcrt.dll")&&PE.isLibraryPresent("USER32.dll"))
+                {
+                    sVersion="4.X";
+                    bDetected=1;
+                }
+            }
+        }
+    } */
+
+    return result();
+}

db/PE/Morphnah.2.sg

@@ -0,0 +1,23 @@
+// Detect It Easy: detection rule file
+
+init("protector", "Morphnah");
+
+function detect() {
+    if (PE.compareEP("558bec87e55de9$$$$$$$$558bec83ec..5356576064a1........8b40..8945..64a1........c740")) {
+        sVersion = "1.0.7";
+        bDetected = true;
+    } else if (PE.section[".nah"]) {
+        if (PE.compareEP("60e8$$$$$$$$5d81ed........8bbd........8b8d........b8........01e88030..83f9..74..817f..........75..8b57")) {
+            sVersion = "1.0.2";
+            bDetected = true;
+        } else if (PE.compareEP("60e8$$$$$$$$5d81ed........31c04083f0..403d........75..be........eb..eb..8b85........83f8..75..31c001ee3d")) {
+            sVersion = "1.0.3";
+            bDetected = true;
+        } else if (PE.compareEP("eb$$608b4c....87d187d18b093bed")) {
+            sVersion = "beta 2";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/Multimedia_Fusion_Installer.1.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "Multimedia Fusion Installer");
+
+function detect() {
+    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965")) {
+        if (PE.compareOverlay("'wwwwI'874712")) {
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/Mystic_Compressor.2.sg

@@ -0,0 +1,15 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("packer", "Mystic Compressor");
+
+function detect() {
+    if (PE.compareEP("558bec83ec..6a..ff35........6a..ff15........8d55..5268........68........ff15........6a..ff35")) {
+        bDetected = true;
+    }
+    if (PE.compareEP("558bec83c4..68........ff15........8945..68........ff75..ff15........8945..8d55..526a..68")) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/N-Joiner.1.sg

@@ -0,0 +1,12 @@
+// Detect It Easy: detection rule file
+
+init("joiner", "N-Joiner");
+
+function detect() {
+    if (PE.compareEP("6A0068........68........6A00E8140000006A00E813000000CCFF25........FF25........FF25........FF25")) {
+        sVersion = "0.1";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/N-Joy.2.sg

@@ -0,0 +1,25 @@
+// Detect It Easy: detection rule file
+
+init("protector", "N-Joy");
+
+function detect() {
+    if (PE.compareEP("558BEC83C4F0B8........E8....FFFF6A0068........6A0A6A00E8....FFFFE8....FFFF8D4000")) {
+        switch (PE.readWord(PE.nEP + 33)) {
+            case 0xf5ef:
+                sVersion = "1.0";
+                break;
+            case 0xf57f:
+                sVersion = "1.1";
+                break;
+            case 0xeac7:
+                sVersion = "1.2";
+                break;
+            case 0xe723:
+                sVersion = "1.3";
+                break;
+        }
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/NETZ.2.sg

@@ -0,0 +1,11 @@
+// Detect It Easy: detection rule file
+
+init("packer", ".NETZ");
+
+function detect() {
+    if (PE.isNET() && PE.isSignatureInSectionPresent(0, "00'NetzStarter'00'netz'00")) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/NET_Spider.2.sg

@@ -0,0 +1,14 @@
+// Detect It Easy: detection rule file
+
+init("protector", ".NET Spider");
+
+function detect() {
+    if (PE.isNET()) {
+        if (PE.isSignatureInSectionPresent(0, "'Protected_By_Attribute'00'NETSpider.Attribute'")) {
+            sVersion = "0.5-1.3";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/NOS_Installer.1.sg

@@ -0,0 +1,22 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("installer", "NOS Installer");
+
+function detect() {
+    if (PE.compareEP("50e8000000005b81eb........b9........2bd98bf381eb........8bfb81eb........575156e8........83c4..8bab........8d2c2b4d8a4d..80f9..74..83ed..8bd32b53")) {
+        if (PE.compareOverlay("'PK??NOS_PO'") || PE.compareOverlay("'NOS_PO'")) {
+            sOptions = "(c) Netopsystems";
+            bDetected = true;
+        }
+    }
+    if (PE.compareEP("e8$$$$$$$$58bb........8bb3........8d0433488a0880f9..74..83e8..8b108bb3........03f38dbb........578bca2bce5156")) {
+        //        if(PE.compareOverlay("'PK??NOS_PO'")||PE.compareOverlay("'NOS_PO'"))
+        //        {
+        sOptions = "(c) Netopsystems";
+        bDetected = true;
+        //        }
+    }
+
+    return result();
+}

db/PE/NOS_Packer.2.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("packer", "NOS Packer");
+
+function detect() {
+    if (PE.compareEP("50e8000000005b81eb........b9........2bd98bf381eb........8bfb81eb........575156e8........83c4..8bab........8d2c2b4d8a4d..80f9..74..83ed..8bd32b53")) {
+        sOptions = "(c) Netopsystems";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/NTShell.2.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+// Author: hypn0 <hypn0@mail.ru>
+
+init("packer", "NTSHELL");
+
+function detect() {
+    if (PE.compareEP("55e8........5d81ed........eb$$eb$$8d85........8dbd........eb$$8db5........eb$$8bcfeb$$2bc84ffdeb$$33dbeb$$8a07eb$$d2c8eb$$2a....eb$$E8")) {
+        sVersion = "5.0";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/NTkrnl_Protector.2.sg

@@ -0,0 +1,37 @@
+// Detect It Easy: detection rule file
+
+init("protector", "NTkrnl Protector");
+
+function detect() {
+    if (PE.compareEP("68........e8") && (PE.nLastSection >= 1)) {
+        if (PE.getNumberOfImports() == 1) {
+            if (PE.getNumberOfImportThunks(0) == 2) {
+                if ((PE.getImportFunctionName(0, 0) == "LoadLibraryA") && (PE.getImportFunctionName(0, 1) == "GetProcAddress")) {
+                    if (PE.isSignatureInSectionPresent(1, "'http://www.ntcore.com  '")) {
+                        sVersion = "0.1";
+                        bDetected = true;
+                    } else if (PE.isSignatureInSectionPresent(1, "'http://www.ntkrnl.com'")) {
+                        sVersion = "0.15";
+                        bDetected = true;
+                    }
+                    /* if(bDetected)
+                    {
+                        var nFind=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,"Version ");
+                        if(nFind!=-1)
+                        {
+                            sVersion=PE.getString(nFind,20);
+                            var aVersion=sVersion.match(/Version ?(.*?) /);
+                            sVersion=aVersion[1];
+                        }
+                    } */
+                }
+
+            }
+        }
+    }
+    if (PE.compareEP("68........e8........c3") && (PE.compareEP("68########60e8$$$$$$$$5d4555c3"))) {
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/NakedPacker.2.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+
+init("packer", "NakedPacker");
+
+function detect() {
+    if (PE.compareEP("60FC0FB605............7531B8........2B05..............................05........A3........E89A000000A3")) {
+        sVersion = "1.0";
+        sOptions = "by BigBoote";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/NanoZip.1.sg

@@ -0,0 +1,16 @@
+// Detect It Easy: detection rule file
+// Author: LinXP
+
+init("sfx", "NanoZip");
+
+function detect() {
+    if (PE.compareEP("60be........8dbe........5789e58d9c24........31c05039dc75")) {
+        if (PE.compareOverlay("AE01'NanoZip 0.09 alpha'")) {
+            sVersion = "0.09a";
+            sOptions = "nz_w32c.sfx";
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/NativeCryptor_by_DosX.2.sg

@@ -0,0 +1,13 @@
+// Detect It Easy: detection rule file
+
+init("cryptor", "NativeCryptor by DosX");
+
+function detect() {
+    if (PE.getNumberOfSections() >= 3) {
+        if (PE.compareOverlay("'7stgc_hdr'00")) {
+            bDetected = true;
+        }
+    }
+
+    return result();
+}

db/PE/Native_UD_Packer.2.sg

@@ -0,0 +1,12 @@
+// Detect It Easy: detection rule file
+
+init("packer", "Native UD Packer");
+
+function detect() {
+    if (PE.compareEP("31C031DB31C9EB0E6A006A006A006A00FF15........FF15........89C768")) {
+        sVersion = "1.1";
+        bDetected = true;
+    }
+
+    return result();
+}

db/PE/NecroVM.Virt.2.sg

@@ -0,0 +1,46 @@
+// Detect It Easy: detection rule file
+// NecroVM by DosX
+
+function detect() {
+    if (PE.isNET()) {
+        if (PE.getString(0x2e, 13) == "It's NecroVM!" &&
+            PE.isSignatureInSectionPresent(0, "5F00'VmLoad'00'mscorlib'")) {
+
+            var nOffset = PE.findString(0x1f0, 16, "v"),
+                version = "";
+
+            if (nOffset != -1) {
+                version = PE.getString(nOffset + 1, 0x1ff - nOffset);
+            }
+            _setResult("packer", "NecroVM Compressor", version, "LZMAT");
+            return ""; // There is no point in analyzing anything further
+        }
+
+        const references = ["System.Reflection", "System.Security.Cryptography", "System.Runtime.InteropServices"];
+        for (var i = 0; i < references.length; i++)
+            if (!PE.isSignatureInSectionPresent(0, "00'" + references[i] + "'00")) // 00'keyValue'00
+                return "";
+
+        const vmCore = "NecroVM.Runtime"; // Virtual machine namespace
+
+        if (PE.isSignatureInSectionPresent(0, "50??'" + vmCore + "'") && PE.isNetObjectPresent(vmCore) && // check for core
+            PE.isSignatureInSectionPresent(0, "'info'00'flags'00'nativeEntry'00'nativeSizeOfCode'")) {
+
+            if (PE.isSignatureInSectionPresent(0, "0005'_'00'_'00")) // code isolation
+                _setResult("protection", "NecroVM Code Container", "", "");
+
+            if (PE.isSignatureInSectionPresent(0, "2000690073002000740061006d00700065007200650064002e00")) // check for anti-tamper
+                _setResult("protection", "NecroVM Anti-Tamper", "", "");
+
+            var options = "Virtualization"
+
+            if (PE.isSignatureInSectionPresent(0, "00'm_1'")) {
+                options += " + Obfuscation"
+            }
+
+            _setResult("protector", "NecroVM", "2.X", options);
+        }
+    }
+
+    return result();
+}

db/PE/NeoLite.2.sg

@@ -0,0 +1,39 @@
+// Detect It Easy: detection rule file
+
+// https://github.com/russdill/Neo-Executable-Decompressor
+init("packer", "NeoLite");
+
+function detect() {
+    if (PE.compareEP("8B4424048D5424FC2305........E8........FF35........50FF25")) {
+        sVersion = "1.0";
+        bDetected = true;
+    } else if (PE.compareEP("E9$$$$$$$$8B44....2305........E8$$$$$$$$5351525657C8......5081ED........8D..........B8........8B1D")) {
+        sVersion = "1.0";
+        bDetected = true;
+    } else if (PE.compareEP("E9") && (PE.compareEP("'NeoLite'", 29) || PE.compareEP("'NeoLite'", 33))) {
+        sVersion = "1.0";
+        bDetected = true;
+    } else if (PE.compareEP("E9A6000000")) {
+        sVersion = "2.0";
+        bDetected = true;
+    } else if (PE.compareEP("8B4424042305........50E8........83C404FE05........0BC074")) {
+        sVersion = "2.0";
+        bDetected = true;
+    } else if (PE.compareEP("e9$$$$$$$$8b4424..8d5424..2e2305........e8........09c074..2eff35")) {
+        sVersion = "1.01";
+        bDetected = true;
+    } else if (PE.compareEP("e9$$$$$$$$e9$$$$$$$$8b4424..8d5424..2e2305........e8........09c074..2eff35")) {
+        sVersion = "1.01";
+        bDetected = true;
+    } else if (PE.compareEP("e9$$$$$$$$e9$$$$$$$$8b4424..8d5424..2305........e8........ff35........50ff25")) {
+        bDetected = true;
+    } else if (PE.compareEP("e9$$$$$$$$8b4424..8d5424..2305........e8........ff35........50ff25")) {
+        sVersion = "2.0";
+        bDetected = true;
+    } else if (PE.compareEP("e9$$$$$$$$8b4424..2305........e8........fe05........ffe0")) {
+        sVersion = "2.0";
+        bDetected = true;
+    }
+
+    return result();
+}