observable:WindowsPEOptionalHeader leaf node


URI

https://unifiedcyberontology.org/ontology/uco/observable#WindowsPEOptionalHeader

Label

WindowsPEOptionalHeader

Description

A Windows PE optional header is a grouping of characteristics unique to the 'optional header' of a Windows PE (Portable Executable) file, consisting of a collection of metadata about the executable code structure of the file.

Shape Properties

Instances of observable:WindowsPEOptionalHeader can have the following properties:

PROPERTY

MIN COUNT

MAX COUNT

VALUE CONSTRAINTS

TYPE

observable:WindowsPEOptionalHeader
observable:addressOfEntryPoint 0 *
xsd:unsignedInt
observable:baseOfCode 0 *
xsd:unsignedInt
observable:checksum 0 *
xsd:unsignedInt
observable:dllCharacteristics 0 *
xsd:unsignedShort
observable:fileAlignment 0 *
xsd:unsignedInt
observable:imageBase 0 *
xsd:unsignedInt
observable:loaderFlags 0 *
xsd:unsignedInt
observable:magic 0 *
xsd:unsignedShort
observable:majorImageVersion 0 *
xsd:unsignedShort
observable:majorLinkerVersion 0 *
xsd:byte
observable:majorOSVersion 0 *
xsd:unsignedShort
observable:majorSubsystemVersion 0 *
xsd:unsignedShort
observable:minorImageVersion 0 *
xsd:unsignedShort
observable:minorLinkerVersion 0 *
xsd:byte
observable:minorOSVersion 0 *
xsd:unsignedShort
observable:minorSubsystemVersion 0 *
xsd:unsignedShort
observable:numberOfRVAAndSizes 0 *
xsd:unsignedInt
observable:sectionAlignment 0 *
xsd:unsignedInt
observable:sizeOfCode 0 *
xsd:unsignedInt
observable:sizeOfHeaders 0 *
xsd:unsignedInt
observable:sizeOfHeapCommit 0 *
xsd:unsignedInt
observable:sizeOfHeapReserve 0 *
xsd:unsignedInt
observable:sizeOfImage 0 *
xsd:unsignedInt
observable:sizeOfInitializedData 0 *
xsd:unsignedInt
observable:sizeOfStackCommit 0 *
xsd:unsignedInt
observable:sizeOfStackReserve 0 *
xsd:unsignedInt
observable:sizeOfUninitializedData 0 *
xsd:unsignedInt
observable:subsystem 0 *
xsd:unsignedShort
observable:win32VersionValue 0 *
xsd:unsignedInt

Implementation

@prefix observable: <https://unifiedcyberontology.org/ontology/uco/observable#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

observable:WindowsPEOptionalHeader a owl:Class,
        sh:NodeShape ;
    rdfs:label "WindowsPEOptionalHeader"@en ;
    rdfs:comment "A Windows PE optional header is a grouping of characteristics unique to the 'optional header' of a Windows PE (Portable Executable) file, consisting of a collection of metadata about the executable code structure of the file."@en ;
    sh:property [ sh:datatype xsd:byte ;
            sh:nodeKind sh:Literal ;
            sh:path observable:majorLinkerVersion ],
        [ sh:datatype xsd:byte ;
            sh:nodeKind sh:Literal ;
            sh:path observable:minorLinkerVersion ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:addressOfEntryPoint ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:baseOfCode ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:checksum ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:fileAlignment ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:imageBase ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:loaderFlags ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:numberOfRVAAndSizes ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sectionAlignment ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfCode ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfHeaders ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfHeapCommit ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfHeapReserve ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfImage ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfInitializedData ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfStackCommit ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfStackReserve ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfUninitializedData ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:win32VersionValue ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:dllCharacteristics ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:magic ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:majorImageVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:majorOSVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:majorSubsystemVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:minorImageVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:minorOSVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:minorSubsystemVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:subsystem ] ;
    sh:targetClass observable:WindowsPEOptionalHeader .