Feature Request: PE rich header hash

[kevross33]

Within pefile a rich header hash could be implemented for PEs.

It is an interesting pivot point and is supported in VirusTotal (with the MD5 hash of the rich header hash). It can be used as a pivot to find similar authored/created malware https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/, https://www.giac.org/paper/grem/6321/leveraging-pe-rich-header-static-alware-etection-linking/169729

A simple demonstration of this is:

import pefile
binary = pefile.PE("FILENAME.exe")
binary.get_rich_header_hash('md5')
binary.get_rich_header_hash('sha256')

[doomedraven]

"rh_hash": self.get_rh_hash(),

https://github.com/kevoreilly/CAPEv2/blob/master/lib/cuckoo/common/objects.py#L644

[doomedraven]

so does current implementation works for you?