Some Malicious PE Stats, (Thu, Aug 27th)
A security researcher used a Python script leveraging the pefile library to analyze a large dataset of malware samples from Malware Bazaar. By examining PE file headers, including the undocumented Rich Header and .NET CLR metadata, he identified trends in compiler usage and revealed that 32-bit PE files remain prevalent. The analysis also highlighted that less common languages like Go and Rust are emerging in malware development.
During a SANS Internet Storm Center session, a researcher explored compiler usage in malicious PE files. He developed a Python script utilizing the pefile library to analyze a substantial collection of malware samples sourced from Malware Bazaar. The research focused on extracting metadata from PE file headers, specifically the undocumented Rich Header and .NET CLR metadata.
What happened
The researcher’s goal was to determine which compilers were used to generate the malware. He employed three techniques to achieve this: examining the Rich Header, analyzing .NET CLR metadata, and scanning for common non-Microsoft compiler signatures (GCC/MinGW, Clang/LLVM, Delphi/Borland, Free Pascal, Go, Rust). The Rich Header, an XOR-obfuscated block within PE files built with the MSVC toolchain, contains information about the linker version, build number, and source file count. The .NET CLR header provides the CLR runtime version and embedded metadata version string.
Technical details
- **Rich Header:** Contains @comp.id (product id + build number) and use-count of every object file.
- **.NET CLR Header:** Provides CLR runtime version and embedded metadata version string.
- **Compiler Signatures:** Scanned for common non-Microsoft compiler signatures.
- **Tools:** pefile library, Malware Bazaar archive downloads (1.3 TB from 2020-02-24 to 2026-07-08).
Impact
The analysis revealed that 32-bit PE files remain a dominant format, indicating a continued reliance on older architectures and potentially less sophisticated detection methods. The identification of specific Rich Header compiler builds allows for clustering samples originating from the same environment or campaign, aiding in threat attribution.
What to do
- **Monitor Rich Header Data:** Track the evolution of Rich Header compiler builds and associated campaign clusters.
- **Analyze Compiler Usage:** Continuously monitor the prevalence of different compilers in malware samples.
- **Threat Intelligence Sharing:** Contribute to community resources like the "comp_id.txt" file.
Why it matters
The research highlights the importance of understanding compiler usage in malware analysis and threat intelligence. Identifying emerging languages like Go and Rust underscores the evolving landscape of malware development and the need for updated detection capabilities.