1\ Surprisingly, you could build a very mediocre PE malware detector with a single PE feature: the PE compile timestamp. In fact, I built a little random forest detector that uses only the timestamp as its feature that gets 62% detection on previously unseen malware at a 1% FPR.
2\ The timestamp field poses a low-key problem for attackers. If they leave the compiler-assigned value they reveal telling details. If they assign a concocted value, their tampering can make them easier to detect. Here's an 'allaple' malware set's random, insane timestamps: 
3\ Now let's look at a big malware dataset's compile timestamp behavior. Notice the straight horizontal lines. Those are unique polymorphic hashes reusing the *same* compile timestamp month after month. Also, notice the number of insane back-to-the-future timestamps.
4\ In contrast, benign files' timestamp behavior is far more well behaved. That line at 1993 is a special case: Delphi binaries all have that timestamp field setting, regardless of when they were created.
5\ From an ML and signatures perspective, the detection signal here comes from two places: 1) there are exact-match timestamps that allow us to detect entire toolkits and polymorphic families. 2) Pathological timestamps are far more likely to come from malware.
6\ The timestamp field has a non-linear (to say the least) but high mutual information relationship with the bad/good labels. Decision trees are a natural modeling fit here. Here's the ROC curve we get when we fit a random forest detector on just the timestamp feature.
