90 lines
2.8 KiB
Markdown
90 lines
2.8 KiB
Markdown
---
|
|
name: analyzing-rich-header-and-compiler-artifacts
|
|
description: 'Analyzes the PE Rich header and related compiler artifacts to fingerprint the build
|
|
toolchain, cluster related samples, and detect inconsistencies that suggest tampering. Activates
|
|
for requests to analyze a Rich header, fingerprint the compiler/linker, or cluster samples by
|
|
build toolchain.'
|
|
domain: cybersecurity
|
|
subdomain: malware-analysis
|
|
tags:
|
|
- malware-analysis
|
|
- pe
|
|
- rich-header
|
|
- toolchain
|
|
- clustering
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1027
|
|
- T1587.001
|
|
- T1036
|
|
d3fend:
|
|
- D3-SDA
|
|
- D3-FA
|
|
references:
|
|
- 'PE Format — https://learn.microsoft.com/windows/win32/debug/pe-format'
|
|
- 'Rich header structure (public reverse-engineering research) — https://learn.microsoft.com/windows/win32/debug/pe-format'
|
|
---
|
|
|
|
# Analyzing Rich Header and Compiler Artifacts
|
|
|
|
## When to Use
|
|
|
|
- You have a Windows PE and want to fingerprint its build toolchain (compiler/linker product IDs
|
|
and build numbers) from the Rich header.
|
|
- You are clustering samples by toolchain or detecting Rich-header tampering/forgery.
|
|
|
|
**Do not use** the Rich header as definitive attribution — it can be copied or stripped. This skill
|
|
reads the PE statically and executes nothing.
|
|
|
|
## Prerequisites
|
|
|
|
- The PE sample (read inertly).
|
|
|
|
## Safety & Handling
|
|
|
|
- Read bytes statically; treat the sample as malicious data.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Parse and decode the Rich header
|
|
|
|
```bash
|
|
python scripts/analyst.py rich sample.exe
|
|
```
|
|
|
|
Locates the `Rich` marker, recovers the XOR key (the DWORD after `Rich`), decodes the `DanS`-
|
|
prefixed entries, and lists `(product_id, build_id, use_count)` tuples.
|
|
|
|
### Step 2: Fingerprint the toolchain
|
|
|
|
Map product IDs to compiler/linker products and build numbers to identify the Visual Studio
|
|
version(s) used.
|
|
|
|
### Step 3: Compute a clustering hash
|
|
|
|
Hash the decoded Rich entries to produce a toolchain fingerprint for grouping related samples.
|
|
|
|
### Step 4: Check for inconsistencies
|
|
|
|
Compare the Rich-derived linker version against the PE optional-header linker version; mismatches
|
|
suggest tampering or a copied header.
|
|
|
|
## Validation
|
|
|
|
- The XOR key correctly decodes the `DanS` signature at the start of the block.
|
|
- Decoded entries have plausible product IDs and use counts.
|
|
- The toolchain fingerprint is reproducible across identical builds.
|
|
|
|
## Pitfalls
|
|
|
|
- Samples with no Rich header (non-MSVC toolchains, stripped headers).
|
|
- Forged Rich headers copied from a benign binary.
|
|
- Confusing the Rich checksum/key handling and misdecoding entries.
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the parser.
|
|
- PE format documentation (linked in frontmatter).
|