Class: StixWindowsPeBinaryExtension

The Windows PE Binary File extension specifies a default extension for capturing properties specific to Windows portable executable (PE) files.

URI: attack:StixWindowsPeBinaryExtension

 classDiagram
    class StixWindowsPeBinaryExtension
    click StixWindowsPeBinaryExtension href "../StixWindowsPeBinaryExtension/"
      StixWindowsPeBinaryExtension : characteristics_hex
        
      StixWindowsPeBinaryExtension : file_header_hashes
        
          
    
        
        
        StixWindowsPeBinaryExtension --> "0..1" StixHashes : file_header_hashes
        click StixHashes href "../StixHashes/"
    

        
      StixWindowsPeBinaryExtension : imphash
        
      StixWindowsPeBinaryExtension : machine_hex
        
      StixWindowsPeBinaryExtension : number_of_sections
        
      StixWindowsPeBinaryExtension : number_of_symbols
        
      StixWindowsPeBinaryExtension : optional_header
        
          
    
        
        
        StixWindowsPeBinaryExtension --> "0..1" StixWindowsPeOptionalHeader : optional_header
        click StixWindowsPeOptionalHeader href "../StixWindowsPeOptionalHeader/"
    

        
      StixWindowsPeBinaryExtension : pe_type
        
      StixWindowsPeBinaryExtension : pointer_to_symbol_table_hex
        
      StixWindowsPeBinaryExtension : sections
        
          
    
        
        
        StixWindowsPeBinaryExtension --> "1..*" StixWindowsPeSection : sections
        click StixWindowsPeSection href "../StixWindowsPeSection/"
    

        
      StixWindowsPeBinaryExtension : size_of_optional_header
        
      StixWindowsPeBinaryExtension : time_date_stamp
        
      

Slots

Name	Cardinality and Range	Description	Inheritance
pe_type	1 String or  StixWindowsPeBinaryType	The type of the PE binary, such as exe or dll	direct
imphash	0..1 String	Specifies the special import hash, or ‘imphash’, calculated for the PE Binary…	direct
machine_hex	0..1 StixHex	Specifies the type of target machine	direct
number_of_sections	0..1 Integer	Specifies the number of sections in the PE binary, as a non-negative integer	direct
time_date_stamp	0..1 StixTimestampSeconds	The time at which the PE binary was created	direct
pointer_to_symbol_table_hex	0..1 StixHex	Specifies the file offset of the COFF symbol table	direct
number_of_symbols	0..1 Integer	Specifies the number of entries in the symbol table of the PE binary, as a no…	direct
size_of_optional_header	0..1 Integer	Specifies the size of the optional header of the PE binary	direct
characteristics_hex	0..1 StixHex	Specifies the flags that indicate the file’s characteristics	direct
file_header_hashes	0..1 StixHashes	Specifies any hashes that were computed for the file header	direct
optional_header	0..1 StixWindowsPeOptionalHeader	Specifies the PE optional header of the PE binary	direct
sections	1..* StixWindowsPeSection	Specifies metadata about the sections in the PE file	direct

Expressions & Logic

Any Of

The class must satisfy at least one of:

• AnonymousClassExpression({ ‘slot_conditions’: {‘imphash’: SlotDefinition({‘name’: ‘imphash’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘machine_hex’: SlotDefinition({‘name’: ‘machine_hex’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘number_of_sections’: SlotDefinition({‘name’: ‘number_of_sections’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘time_date_stamp’: SlotDefinition({‘name’: ‘time_date_stamp’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘pointer_to_symbol_table_hex’: SlotDefinition({‘name’: ‘pointer_to_symbol_table_hex’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘number_of_symbols’: SlotDefinition({‘name’: ‘number_of_symbols’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘size_of_optional_header’: SlotDefinition({‘name’: ‘size_of_optional_header’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘characteristics_hex’: SlotDefinition({‘name’: ‘characteristics_hex’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘file_header_hashes’: SlotDefinition({‘name’: ‘file_header_hashes’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘optional_header’: SlotDefinition({‘name’: ‘optional_header’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘sections’: SlotDefinition({‘name’: ‘sections’, ‘required’: True})} })

Identifier and Mapping Information

Annotations

property	value
stix_extension_name	windows-pebinary-ext

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:StixWindowsPeBinaryExtension
native	attack:StixWindowsPeBinaryExtension
close	uco-observable:WindowsPEBinaryFileFacet

LinkML Source

Direct

name: StixWindowsPeBinaryExtension
annotations:
  stix_extension_name:
    tag: stix_extension_name
    value: windows-pebinary-ext
description: The Windows PE Binary File extension specifies a default extension for
  capturing properties specific to Windows portable executable (PE) files.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:WindowsPEBinaryFileFacet
slots:
- pe_type
- imphash
- machine_hex
- number_of_sections
- time_date_stamp
- pointer_to_symbol_table_hex
- number_of_symbols
- size_of_optional_header
- characteristics_hex
- file_header_hashes
- optional_header
- sections
slot_usage:
  pe_type:
    name: pe_type
    required: true
any_of:
- slot_conditions:
    imphash:
      name: imphash
      required: true
- slot_conditions:
    machine_hex:
      name: machine_hex
      required: true
- slot_conditions:
    number_of_sections:
      name: number_of_sections
      required: true
- slot_conditions:
    time_date_stamp:
      name: time_date_stamp
      required: true
- slot_conditions:
    pointer_to_symbol_table_hex:
      name: pointer_to_symbol_table_hex
      required: true
- slot_conditions:
    number_of_symbols:
      name: number_of_symbols
      required: true
- slot_conditions:
    size_of_optional_header:
      name: size_of_optional_header
      required: true
- slot_conditions:
    characteristics_hex:
      name: characteristics_hex
      required: true
- slot_conditions:
    file_header_hashes:
      name: file_header_hashes
      required: true
- slot_conditions:
    optional_header:
      name: optional_header
      required: true
- slot_conditions:
    sections:
      name: sections
      required: true

Induced

name: StixWindowsPeBinaryExtension
annotations:
  stix_extension_name:
    tag: stix_extension_name
    value: windows-pebinary-ext
description: The Windows PE Binary File extension specifies a default extension for
  capturing properties specific to Windows portable executable (PE) files.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:WindowsPEBinaryFileFacet
slot_usage:
  pe_type:
    name: pe_type
    required: true
attributes:
  pe_type:
    name: pe_type
    description: The type of the PE binary, such as exe or dll.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:pe_type
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: string
    required: true
    any_of:
    - range: StixWindowsPeBinaryType
    - range: string
  imphash:
    name: imphash
    description: Specifies the special import hash, or 'imphash', calculated for the
      PE Binary based on its imported libraries and functions.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:imphash
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: string
  machine_hex:
    name: machine_hex
    description: Specifies the type of target machine.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:machine_hex
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: stix_hex
  number_of_sections:
    name: number_of_sections
    description: Specifies the number of sections in the PE binary, as a non-negative
      integer.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:number_of_sections
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: integer
    minimum_value: 0
  time_date_stamp:
    name: time_date_stamp
    description: The time at which the PE binary was created.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:time_date_stamp
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: stix_timestamp_seconds
  pointer_to_symbol_table_hex:
    name: pointer_to_symbol_table_hex
    description: Specifies the file offset of the COFF symbol table.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:pointer_to_symbol_table_hex
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: stix_hex
  number_of_symbols:
    name: number_of_symbols
    description: Specifies the number of entries in the symbol table of the PE binary,
      as a non-negative integer.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:number_of_symbols
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: integer
    minimum_value: 0
  size_of_optional_header:
    name: size_of_optional_header
    description: Specifies the size of the optional header of the PE binary.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size_of_optional_header
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: integer
    minimum_value: 0
  characteristics_hex:
    name: characteristics_hex
    description: Specifies the flags that indicate the file's characteristics.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:characteristics_hex
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: stix_hex
  file_header_hashes:
    name: file_header_hashes
    description: Specifies any hashes that were computed for the file header.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:file_header_hashes
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: StixHashes
    inlined: true
  optional_header:
    name: optional_header
    description: Specifies the PE optional header of the PE binary.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:optional_header
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: StixWindowsPeOptionalHeader
    inlined: true
  sections:
    name: sections
    description: Specifies metadata about the sections in the PE file.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:sections
    owner: StixWindowsPeBinaryExtension
    domain_of:
    - StixWindowsPeBinaryExtension
    range: StixWindowsPeSection
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
any_of:
- slot_conditions:
    imphash:
      name: imphash
      required: true
- slot_conditions:
    machine_hex:
      name: machine_hex
      required: true
- slot_conditions:
    number_of_sections:
      name: number_of_sections
      required: true
- slot_conditions:
    time_date_stamp:
      name: time_date_stamp
      required: true
- slot_conditions:
    pointer_to_symbol_table_hex:
      name: pointer_to_symbol_table_hex
      required: true
- slot_conditions:
    number_of_symbols:
      name: number_of_symbols
      required: true
- slot_conditions:
    size_of_optional_header:
      name: size_of_optional_header
      required: true
- slot_conditions:
    characteristics_hex:
      name: characteristics_hex
      required: true
- slot_conditions:
    file_header_hashes:
      name: file_header_hashes
      required: true
- slot_conditions:
    optional_header:
      name: optional_header
      required: true
- slot_conditions:
    sections:
      name: sections
      required: true