The Windows Forensic Journey — Rich Header

The “Rich Header” is an optional and undocumented structure in a PE executable (https://learn.microsoft.com/en-us/windows/win32/debug/pe-format). It stores metadata about the toolchain used during compilation, which includes the versions of compilers and linkers that built individual object files. Although not officially documented by Microsoft, it is valuable in forensic analysis for identifying similarities between binaries. For example, determining whether multiple executables were likely produced from the same project or build environment (https://theses.hal.science/tel-05470254v1/document). By the way the absence of a rich header indicates the file is potentially packed or obfuscated (https://farros.co/blog/flarevm-arsenal-of-tools-tryhackme-write-up/).

Overall, the rich header is commonly found in binaries compiled with Microsoft Visual Studio. The header contains a series of integer pairs. Each pair encodes the compiler identifier and the count of objects it produced. These values are used to generate a hash of the rich header, which can serve as a useful artifact for clustering samples and attributing them to specific threat groups used by forensic\malware tools\investigators (https://docs.trellix.com/bundle/10.x_ug/page/UUID-fd797184-65ab-86e4-ec99-b05a723928ad.html). The rich header (introduced quietly with Visual Studio 97 SP3) is embedded between the IMAGE_DOS_HEADER (https://medium.com/@boutnaru/the-portable-executable-journey-dos-header-ea5b29f15612) and the IMAGE_NT_HEADERS (https://medium.com/@boutnaru/the-portable-executable-journey-nt-headers-struct-image-nt-headers32-64-d2afffafebe2).

Lastly, the header is XOR encrypted and bounded by the “DanS” marker at its start and the “Rich” marker at its end, followed by the XOR key (a checksum derived from the DOS header, stub, and rich data). Internally, it consists of an array of 64-bit entries (PRODITEMs), each encoding a tool identifier (ProdID) and usage count — as shown in the diagram below. These ProdIDs correspond to components of the Visual Studio toolchain (like compilers, linkers). Thus, allowing to infer which tools and build versions were used to produce the binary (https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/).

See you in my next writeup ;-) You can follow me on twitter — @boutnaru (https://twitter.com/boutnaru). Also, you can read my other writeups on medium — https://medium.com/@boutnaru. You can find my free eBooks at https://TheLearningJourneyEbooks.com.

https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/