| name | analyzing-rich-header-and-compiler-artifacts |
| description | Analyzes the PE Rich header and related compiler artifacts to fingerprint the build toolchain, cluster related samples, and detect inconsistencies that suggest tampering. Activates for requests to analyze a Rich header, fingerprint the compiler/linker, or cluster samples by build toolchain. |
| domain | cybersecurity |
| subdomain | malware-analysis |
| tags | ["malware-analysis","pe","rich-header","toolchain","clustering"] |
| version | 1.0.0 |
| author | analyst-ai-pack |
| license | Apache-2.0 |
| mitre_attack | ["T1027","T1587.001","T1036"] |
| d3fend | ["D3-SDA","D3-FA"] |
| references | ["PE Format — https://learn.microsoft.com/windows/win32/debug/pe-format","Rich header structure (public reverse-engineering research) — https://learn.microsoft.com/windows/win32/debug/pe-format"] |
Analyzing Rich Header and Compiler Artifacts
When to Use
- You have a Windows PE and want to fingerprint its build toolchain (compiler/linker product IDs
and build numbers) from the Rich header.
- You are clustering samples by toolchain or detecting Rich-header tampering/forgery.
Do not use the Rich header as definitive attribution — it can be copied or stripped. This skill
reads the PE statically and executes nothing.
Prerequisites
- The PE sample (read inertly).
Safety & Handling
- Read bytes statically; treat the sample as malicious data.
Workflow
Step 1: Parse and decode the Rich header
python scripts/analyst.py rich sample.exe
Locates the Rich marker, recovers the XOR key (the DWORD after Rich), decodes the DanS-
prefixed entries, and lists (product_id, build_id, use_count) tuples.
Step 2: Fingerprint the toolchain
Map product IDs to compiler/linker products and build numbers to identify the Visual Studio
version(s) used.
Step 3: Compute a clustering hash
Hash the decoded Rich entries to produce a toolchain fingerprint for grouping related samples.
Step 4: Check for inconsistencies
Compare the Rich-derived linker version against the PE optional-header linker version; mismatches
suggest tampering or a copied header.
Validation
- The XOR key correctly decodes the
DanS signature at the start of the block.
- Decoded entries have plausible product IDs and use counts.
- The toolchain fingerprint is reproducible across identical builds.
Pitfalls
- Samples with no Rich header (non-MSVC toolchains, stripped headers).
- Forged Rich headers copied from a benign binary.
- Confusing the Rich checksum/key handling and misdecoding entries.
References
