reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-rich-header-and-compiler-artifacts/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-rich-header-and-compiler-artifacts	Analyzes the PE Rich header and related compiler artifacts to fingerprint the build toolchain, cluster related samples, and detect inconsistencies that suggest tampering. Activates for requests to analyze a Rich header, fingerprint the compiler/linker, or cluster samples by build toolchain.	cybersecurity	malware-analysis	malware-analysis pe rich-header toolchain clustering	1.0.0	analyst-ai-pack	Apache-2.0	T1027 T1587.001 T1036	D3-SDA D3-FA	PE Format — https://learn.microsoft.com/windows/win32/debug/pe-format Rich header structure (public reverse-engineering research) — https://learn.microsoft.com/windows/win32/debug/pe-format

Analyzing Rich Header and Compiler Artifacts

When to Use

• You have a Windows PE and want to fingerprint its build toolchain (compiler/linker product IDs and build numbers) from the Rich header.
• You are clustering samples by toolchain or detecting Rich-header tampering/forgery.

Do not use the Rich header as definitive attribution — it can be copied or stripped. This skill reads the PE statically and executes nothing.

Prerequisites

• The PE sample (read inertly).

Safety & Handling

• Read bytes statically; treat the sample as malicious data.

Workflow

Step 1: Parse and decode the Rich header

python scripts/analyst.py rich sample.exe

Locates the Rich marker, recovers the XOR key (the DWORD after Rich), decodes the DanS- prefixed entries, and lists (product_id, build_id, use_count) tuples.

Step 2: Fingerprint the toolchain

Map product IDs to compiler/linker products and build numbers to identify the Visual Studio version(s) used.

Step 3: Compute a clustering hash

Hash the decoded Rich entries to produce a toolchain fingerprint for grouping related samples.

Step 4: Check for inconsistencies

Compare the Rich-derived linker version against the PE optional-header linker version; mismatches suggest tampering or a copied header.

Validation

• The XOR key correctly decodes the DanS signature at the start of the block.
• Decoded entries have plausible product IDs and use counts.
• The toolchain fingerprint is reproducible across identical builds.

Pitfalls

• Samples with no Rich header (non-MSVC toolchains, stripped headers).
• Forged Rich headers copied from a benign binary.
• Confusing the Rich checksum/key handling and misdecoding entries.

References

• See references/api-reference.md for the parser.
• PE format documentation (linked in frontmatter).