I was wondering when people compile malware and use the compiled files for engagements or nefarious purposes, what evidence do they leave behind in the compiled Windows executables? I have heard that the OS usernames of the compilers can be disclosed upon analysis of the executable. Is it true? Is the evidence left behind the same both for .NET and native applications?
Yes it is true.
Both .Net and native applications (atleast those compiled by Visual Studio) contain an absolute path to a .pdb (Program Database) file when compiled in debug mode (which is usually the default). Since paths in Windows are usually of the form
C:\Users\UserName\..., the path also reveals the malware author's OS username along with some information about the directory structure on their computer. It could also be possible to use it to deduce something about your nationality and/or locality. For example, if the path contains Chinese characters, it would be safe to say that the author is Chinese (and might live in China).
Portable executable headers also contain a TimeDateStamp which indicates the time at which the file was created/compiled. This could be used to roughly infer the possible time zone(s) in which the malware author resides (atleast for professional malware developers who can be expected to work during normal working hours. Amateur developers probably work at unpredictable hours).