Glossary Forensics

Compile timestamp

The compile timestamp is a date stored in a Windows executable's header, in seconds since 1970, recording when it was linked.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

It can hint at when a sample was built, but it is trivial to forge, and many modern builds set it to zero or a hash for reproducibility. Treat it as a clue to cross-check against other evidence, not as proof. See Unix timestamp and Timestomping. In a Portable Executable (PE) file the value is the 32-bit TimeDateStamp field of the COFF file header, eight bytes after the PE\0\0 signature, stored little-endian as seconds since 1970-01-01 UTC. Debug directories, resources and digital signatures can carry further timestamps worth comparing.

Why it matters

Analysts use the stamp to cluster samples from the same campaign and to place a build in a timeline. A date in the future, before the compiler existed, or out of line with the signing date suggests tampering; with reproducible builds the field may not be a date at all, so a "1970" or odd 2050 value is not by itself suspicious.

Example

In the 64-bit gui-64.exe launcher shipped with Python's setuptools, the PE signature sits at offset 0x100:

00000100: 5045 0000 6486 0600 ea27 6864 ...
          P E \0\0  machine  sections  TimeDateStamp

The bytes EA 27 68 64 read little-endian give 0x646827EA = 1684547562, which is 2023-05-20 01:52:42 UTC. The Executable Forensics decodes this field automatically.

AdSense Placeholder
Slot: footer_leaderboard