TimeDateStamps In PE Files

//http://waleedassar.blogspot.com/
//http://www.twitter.com/waleedassar
//This shows several places where you can find TimeDateStamp occurrences  in PE files.

1) The "TimeDateStamp" field of the "IMAGE_FILE_HEADER" structure.
//This is the most notorious place, always a target for both malware designers and forensic guys.
//N.B. Certain versions of Delphi linkers always emit a fixed TimeDateStamp of 0x2A425E19, in this case you should not rely on this TDS field.

2) The "TimeDateStamp" field of the "IMAGE_EXPORT_DIRECTORY" structure.
//Usually the same as or very close to the "TimeDateStamp" field of the "the "IMAGE_FILE_HEADER" structure".
//N.B. Not all linkers fill this field, but Microsoft Visual Studio linkers do fill it for both DLL's and EXE's.

3) The "TimeDateStamp" field of the "IMAGE_IMPORT_DESCRIPTOR" structure.
//Unlike what the name implies, this field is abit useless if you are trying to determine when the executable was built. It is -1 if the executable/dll is bound (see #8) and zero if not bound.

4) The "TimeDateStamp" field of the "IMAGE_RESOURCE_DIRECTORY" structure.
//Usually Microsoft Visual Studio linkers don't set it (I have tested with linker versions of 6.0, 8.0, 9.0, // and 10.0).
//Borland C and Delphi set this field for the main IMAGE_RESOURCE_DIRECTORY and its subdirectories.
//Sometimes spoofers may forget to forge this field for subdirectories, beware of that.

5) The "TimeDateStamp" of the "IMAGE_DEBUG_DIRECTORY" structures.
//Microsoft Visual Studio linkers emitting debug info. in the final PE always set this field.
//Spoofers may forge the field in the first "IMAGE_DEBUG_DIRECTORY" structure and forget the following ones.

6) If the IMAGE_DEBUG_DIRECTORY has the "Type" field set to 0x2 (IMAGE_DEBUG_TYPE_CODEVIEW), then by following the "PointerToRawData" field we can find another TimeDateStamp.
http://uploadpic.org/v.php?img=beQsqVavvW

7) The "TimeDateStamp" field of the "IMAGE_LOAD_CONFIG_DIRECTORY" structure.
//I have not seen it being used before.

8) The "TimeDateStamp" field of the "IMAGE_BOUND_IMPORT_DESCRIPTOR" structures.
//The TimeDateStamp of the DLL that the executable is bound to.
//We can't use this field to know when the executable was build, but we can use it to determine on which Windows version/Service pack the file was built/bound.