Do you remember the infamous
Rich signature the VC compiler leaves in any PE executable it generates? Tell you what guys, there are many more of them, albeit less obvious, spread all around the file. AV SW uses them as a means to identify the compiler and eliminate the unwanted competitors. That's how VB6 came to the point of being flagged as malware regardless of manifests, version info, or PE header compliance...