The property specifies Size_Of_Optional_Header cyboxCommon: Size_Of_Optional_Header 0..1 the size of the optional header. It should be 0 for object HexBinaryObjectPropertyType files and non-zero for executables. The property specifies the flags that cyboxCommon: Characteristics Characteristics 0..1 indicate the file's characteristics. HexBinaryObjectPropertyType The property specifies any hashes computed for Hashes Hashes 0..1 cyboxCommon:HashListType the Optional Header. Data Type The data type specifies the subsystem type. Its core value SHOULD be a literal from the enumeration. It SubsystemType SubsystemTypeEnum extends the data type, in order to permit complex (i.e. regular-expression based) specifications. BaseObjectPropertyType Data Type The data type specifies the PE file type. Its core value SHOULD be a literal from the enumeration. It extends the PEType PETypeEnum data type, in order to permit complex (i.e. regular-expression based) specifications. BaseObjectPropertyType Class The describes the PE Optional Header structure. Additional computed metadata, e.g., hashes of the header, are PEOptionalHeaderType also included. The property table of the class is given in Table 321. PEOptionalHeaderType Table . Properties of the class PEOptionalHeaderType Name Type Multiplicity Description The property specifies the unsigned integer that Magic Magic cyboxCommon: 0..1 indicates the type of executable file.
Size_Of_Optional_Header cyboxCommon: HexBinaryObjectPropertyType 0..1 The Size_Of_Optional_Header property specifies the size of the optional header. It should be 0 for object files and non-zero for executables. Characteristics cyboxCommon: HexBinaryObjectPropertyType 0..1 The Characteristics property specifies the flags that indicate the file's characteristics. Hashes cyboxCommon:HashListType 0..1 The Hashes property specifies any hashes computed for the Optional Header. Data Type The SubsystemType data type specifies the subsystem type. Its core value SHOULD be a literal from the SubsystemTypeEnum enumeration. It extends the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications. Data Type The PEType data type specifies the PE file type. Its core value SHOULD be a literal from the PETypeEnum enumeration. It extends the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications. Class The PEOptionalHeaderType describes the PE Optional Header structure. Additional computed metadata, e.g., hashes of the header, are also included. The property table of the PEOptionalHeaderType class is given in Table 321. Table . Properties of the PEOptionalHeaderType class Name Type Multiplicity Description Magic cyboxCommon: 0..1 The Magic property specifies the unsigned integer that indicates the type of executable file.
cybox-v2.1.1-csprd01-part69-win-executable-file.docx