I've read that a malware found by kaspersky was compiled at the moscow time zone. How they know the time of compilation ?
It is possible to get the compilation/linking date/time, for instance from the COFFHeader.TimeDateStamp field. But that doesn't give you the time zone as the field is just "the number of seconds elapsed since midnight (00:00:00), January 1, 1970, UTC". I presume Kaspersky concluded a Moscow TZ by looking at the compile date/time of multiple different versions and seeing most are between 4AM UTC (8AM Moscow) and 2PM UTC (6PM Moscow) (similar to an analysis FireEye did in their Apt28 report, page 27).