Neat idea: tool correlates multiple PE header fields to find compile timestamp manipulation. https://twitter.com/MissMalwareBlog/status/834574354864291840