Class: StixWindowsPeOptionalHeader

The optional header of a Windows PE binary.

URI: attack:StixWindowsPeOptionalHeader

 classDiagram
    class StixWindowsPeOptionalHeader
    click StixWindowsPeOptionalHeader href "../StixWindowsPeOptionalHeader/"
      StixWindowsPeOptionalHeader : address_of_entry_point
        
      StixWindowsPeOptionalHeader : base_of_code
        
      StixWindowsPeOptionalHeader : base_of_data
        
      StixWindowsPeOptionalHeader : checksum_hex
        
      StixWindowsPeOptionalHeader : dll_characteristics_hex
        
      StixWindowsPeOptionalHeader : file_alignment
        
      StixWindowsPeOptionalHeader : hashes
        
          
    
        
        
        StixWindowsPeOptionalHeader --> "0..1" StixHashes : hashes
        click StixHashes href "../StixHashes/"
    

        
      StixWindowsPeOptionalHeader : image_base
        
      StixWindowsPeOptionalHeader : loader_flags_hex
        
      StixWindowsPeOptionalHeader : magic_hex
        
      StixWindowsPeOptionalHeader : major_image_version
        
      StixWindowsPeOptionalHeader : major_linker_version
        
      StixWindowsPeOptionalHeader : major_os_version
        
      StixWindowsPeOptionalHeader : major_subsystem_version
        
      StixWindowsPeOptionalHeader : minor_image_version
        
      StixWindowsPeOptionalHeader : minor_linker_version
        
      StixWindowsPeOptionalHeader : minor_os_version
        
      StixWindowsPeOptionalHeader : minor_subsystem_version
        
      StixWindowsPeOptionalHeader : number_of_rva_and_sizes
        
      StixWindowsPeOptionalHeader : section_alignment
        
      StixWindowsPeOptionalHeader : size_of_code
        
      StixWindowsPeOptionalHeader : size_of_headers
        
      StixWindowsPeOptionalHeader : size_of_heap_commit
        
      StixWindowsPeOptionalHeader : size_of_heap_reserve
        
      StixWindowsPeOptionalHeader : size_of_image
        
      StixWindowsPeOptionalHeader : size_of_initialized_data
        
      StixWindowsPeOptionalHeader : size_of_stack_commit
        
      StixWindowsPeOptionalHeader : size_of_stack_reserve
        
      StixWindowsPeOptionalHeader : size_of_uninitialized_data
        
      StixWindowsPeOptionalHeader : subsystem_hex
        
      StixWindowsPeOptionalHeader : win32_version_value_hex
        
      

Slots

Name	Cardinality and Range	Description	Inheritance
magic_hex	0..1 StixHex	Specifies the unsigned integer that indicates the type of the PE binary	direct
major_linker_version	0..1 Integer	Specifies the linker major version number	direct
minor_linker_version	0..1 Integer	Specifies the linker minor version number	direct
size_of_code	0..1 Integer	Specifies the size of the code (text) section	direct
size_of_initialized_data	0..1 Integer	Specifies the size of the initialized data section	direct
size_of_uninitialized_data	0..1 Integer	Specifies the size of the uninitialized data section	direct
address_of_entry_point	0..1 Integer	Specifies the address of the entry point relative to the image base when the …	direct
base_of_code	0..1 Integer	Specifies the address that is relative to the image base of the beginning-of-…	direct
base_of_data	0..1 Integer	Specifies the address that is relative to the image base of the beginning-of-…	direct
image_base	0..1 Integer	Specifies the preferred address of the first byte of the image when loaded in…	direct
section_alignment	0..1 Integer	Specifies the alignment (in bytes) of PE sections when they are loaded into m…	direct
file_alignment	0..1 Integer	Specifies the factor (in bytes) that is used to align the raw data of section…	direct
major_os_version	0..1 Integer	Specifies the major version number of the required operating system	direct
minor_os_version	0..1 Integer	Specifies the minor version number of the required operating system	direct
major_image_version	0..1 Integer	Specifies the major version number of the image	direct
minor_image_version	0..1 Integer	Specifies the minor version number of the image	direct
major_subsystem_version	0..1 Integer	Specifies the major version number of the subsystem	direct
minor_subsystem_version	0..1 Integer	Specifies the minor version number of the subsystem	direct
win32_version_value_hex	0..1 StixHex	Specifies the reserved win32 version value	direct
size_of_image	0..1 Integer	Specifies the size, in bytes, of the image, including all headers, as the ima…	direct
size_of_headers	0..1 Integer	Specifies the combined size of the MS-DOS, PE header, and section headers, ro…	direct
checksum_hex	0..1 StixHex	Specifies the checksum of the PE binary	direct
subsystem_hex	0..1 StixHex	The subsystem, such as a GUI or a device driver, needed to run the image	direct
dll_characteristics_hex	0..1 StixHex	Specifies the flags that characterize the PE binary	direct
size_of_stack_reserve	0..1 Integer	Specifies the size of the stack to reserve	direct
size_of_stack_commit	0..1 Integer	Specifies the size of the stack to commit	direct
size_of_heap_reserve	0..1 Integer	Specifies the size of the local heap space to reserve	direct
size_of_heap_commit	0..1 Integer	Specifies the size of the local heap space to commit	direct
loader_flags_hex	0..1 StixHex	Specifies the reserved loader flags	direct
number_of_rva_and_sizes	0..1 Integer	Specifies the number of data-directory entries in the remainder of the option…	direct
hashes	0..1 StixHashes	A dictionary of hashes of the content, keyed by hash algorithm	direct

Expressions & Logic

Any Of

The class must satisfy at least one of:

• AnonymousClassExpression({ ‘slot_conditions’: {‘magic_hex’: SlotDefinition({‘name’: ‘magic_hex’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘major_linker_version’: SlotDefinition({‘name’: ‘major_linker_version’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘minor_linker_version’: SlotDefinition({‘name’: ‘minor_linker_version’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘size_of_code’: SlotDefinition({‘name’: ‘size_of_code’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘size_of_initialized_data’: SlotDefinition({‘name’: ‘size_of_initialized_data’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘size_of_uninitialized_data’: SlotDefinition({‘name’: ‘size_of_uninitialized_data’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘address_of_entry_point’: SlotDefinition({‘name’: ‘address_of_entry_point’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘base_of_code’: SlotDefinition({‘name’: ‘base_of_code’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘base_of_data’: SlotDefinition({‘name’: ‘base_of_data’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘image_base’: SlotDefinition({‘name’: ‘image_base’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘section_alignment’: SlotDefinition({‘name’: ‘section_alignment’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘file_alignment’: SlotDefinition({‘name’: ‘file_alignment’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘major_os_version’: SlotDefinition({‘name’: ‘major_os_version’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘minor_os_version’: SlotDefinition({‘name’: ‘minor_os_version’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘major_image_version’: SlotDefinition({‘name’: ‘major_image_version’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘minor_image_version’: SlotDefinition({‘name’: ‘minor_image_version’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘major_subsystem_version’: SlotDefinition({‘name’: ‘major_subsystem_version’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘minor_subsystem_version’: SlotDefinition({‘name’: ‘minor_subsystem_version’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘win32_version_value_hex’: SlotDefinition({‘name’: ‘win32_version_value_hex’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘size_of_image’: SlotDefinition({‘name’: ‘size_of_image’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘size_of_headers’: SlotDefinition({‘name’: ‘size_of_headers’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘checksum_hex’: SlotDefinition({‘name’: ‘checksum_hex’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘subsystem_hex’: SlotDefinition({‘name’: ‘subsystem_hex’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘dll_characteristics_hex’: SlotDefinition({‘name’: ‘dll_characteristics_hex’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘size_of_stack_reserve’: SlotDefinition({‘name’: ‘size_of_stack_reserve’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘size_of_stack_commit’: SlotDefinition({‘name’: ‘size_of_stack_commit’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘size_of_heap_reserve’: SlotDefinition({‘name’: ‘size_of_heap_reserve’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘size_of_heap_commit’: SlotDefinition({‘name’: ‘size_of_heap_commit’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘loader_flags_hex’: SlotDefinition({‘name’: ‘loader_flags_hex’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘number_of_rva_and_sizes’: SlotDefinition({‘name’: ‘number_of_rva_and_sizes’, ‘required’: True})} })
• AnonymousClassExpression({ ‘slot_conditions’: {‘hashes’: SlotDefinition({‘name’: ‘hashes’, ‘required’: True})} })

Usages

used by	used in	type	used
StixWindowsPeBinaryExtension	optional_header	range	StixWindowsPeOptionalHeader

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/attack

Mappings

Mapping Type	Mapped Value
self	attack:StixWindowsPeOptionalHeader
native	attack:StixWindowsPeOptionalHeader
close	uco-observable:WindowsPEOptionalHeader

LinkML Source

Direct

name: StixWindowsPeOptionalHeader
description: The optional header of a Windows PE binary.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:WindowsPEOptionalHeader
slots:
- magic_hex
- major_linker_version
- minor_linker_version
- size_of_code
- size_of_initialized_data
- size_of_uninitialized_data
- address_of_entry_point
- base_of_code
- base_of_data
- image_base
- section_alignment
- file_alignment
- major_os_version
- minor_os_version
- major_image_version
- minor_image_version
- major_subsystem_version
- minor_subsystem_version
- win32_version_value_hex
- size_of_image
- size_of_headers
- checksum_hex
- subsystem_hex
- dll_characteristics_hex
- size_of_stack_reserve
- size_of_stack_commit
- size_of_heap_reserve
- size_of_heap_commit
- loader_flags_hex
- number_of_rva_and_sizes
- hashes
any_of:
- slot_conditions:
    magic_hex:
      name: magic_hex
      required: true
- slot_conditions:
    major_linker_version:
      name: major_linker_version
      required: true
- slot_conditions:
    minor_linker_version:
      name: minor_linker_version
      required: true
- slot_conditions:
    size_of_code:
      name: size_of_code
      required: true
- slot_conditions:
    size_of_initialized_data:
      name: size_of_initialized_data
      required: true
- slot_conditions:
    size_of_uninitialized_data:
      name: size_of_uninitialized_data
      required: true
- slot_conditions:
    address_of_entry_point:
      name: address_of_entry_point
      required: true
- slot_conditions:
    base_of_code:
      name: base_of_code
      required: true
- slot_conditions:
    base_of_data:
      name: base_of_data
      required: true
- slot_conditions:
    image_base:
      name: image_base
      required: true
- slot_conditions:
    section_alignment:
      name: section_alignment
      required: true
- slot_conditions:
    file_alignment:
      name: file_alignment
      required: true
- slot_conditions:
    major_os_version:
      name: major_os_version
      required: true
- slot_conditions:
    minor_os_version:
      name: minor_os_version
      required: true
- slot_conditions:
    major_image_version:
      name: major_image_version
      required: true
- slot_conditions:
    minor_image_version:
      name: minor_image_version
      required: true
- slot_conditions:
    major_subsystem_version:
      name: major_subsystem_version
      required: true
- slot_conditions:
    minor_subsystem_version:
      name: minor_subsystem_version
      required: true
- slot_conditions:
    win32_version_value_hex:
      name: win32_version_value_hex
      required: true
- slot_conditions:
    size_of_image:
      name: size_of_image
      required: true
- slot_conditions:
    size_of_headers:
      name: size_of_headers
      required: true
- slot_conditions:
    checksum_hex:
      name: checksum_hex
      required: true
- slot_conditions:
    subsystem_hex:
      name: subsystem_hex
      required: true
- slot_conditions:
    dll_characteristics_hex:
      name: dll_characteristics_hex
      required: true
- slot_conditions:
    size_of_stack_reserve:
      name: size_of_stack_reserve
      required: true
- slot_conditions:
    size_of_stack_commit:
      name: size_of_stack_commit
      required: true
- slot_conditions:
    size_of_heap_reserve:
      name: size_of_heap_reserve
      required: true
- slot_conditions:
    size_of_heap_commit:
      name: size_of_heap_commit
      required: true
- slot_conditions:
    loader_flags_hex:
      name: loader_flags_hex
      required: true
- slot_conditions:
    number_of_rva_and_sizes:
      name: number_of_rva_and_sizes
      required: true
- slot_conditions:
    hashes:
      name: hashes
      required: true

Induced

name: StixWindowsPeOptionalHeader
description: The optional header of a Windows PE binary.
from_schema: https://w3id.org/lmodel/attack
close_mappings:
- uco-observable:WindowsPEOptionalHeader
attributes:
  magic_hex:
    name: magic_hex
    description: Specifies the unsigned integer that indicates the type of the PE
      binary.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:magic_hex
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: stix_hex
  major_linker_version:
    name: major_linker_version
    description: Specifies the linker major version number.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:major_linker_version
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  minor_linker_version:
    name: minor_linker_version
    description: Specifies the linker minor version number.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:minor_linker_version
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  size_of_code:
    name: size_of_code
    description: Specifies the size of the code (text) section. If there are multiple
      such sections, this refers to the sum of the sizes of each section.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size_of_code
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
    minimum_value: 0
  size_of_initialized_data:
    name: size_of_initialized_data
    description: Specifies the size of the initialized data section. If there are
      multiple such sections, this refers to the sum of the sizes of each section.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size_of_initialized_data
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
    minimum_value: 0
  size_of_uninitialized_data:
    name: size_of_uninitialized_data
    description: Specifies the size of the uninitialized data section. If there are
      multiple such sections, this refers to the sum of the sizes of each section.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size_of_uninitialized_data
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
    minimum_value: 0
  address_of_entry_point:
    name: address_of_entry_point
    description: Specifies the address of the entry point relative to the image base
      when the executable is loaded into memory.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:address_of_entry_point
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  base_of_code:
    name: base_of_code
    description: Specifies the address that is relative to the image base of the beginning-of-code
      section when it is loaded into memory.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:base_of_code
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  base_of_data:
    name: base_of_data
    description: Specifies the address that is relative to the image base of the beginning-of-data
      section when it is loaded into memory.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:base_of_data
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  image_base:
    name: image_base
    description: Specifies the preferred address of the first byte of the image when
      loaded into memory.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:image_base
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  section_alignment:
    name: section_alignment
    description: Specifies the alignment (in bytes) of PE sections when they are loaded
      into memory.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:section_alignment
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  file_alignment:
    name: file_alignment
    description: Specifies the factor (in bytes) that is used to align the raw data
      of sections in the image file.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:file_alignment
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  major_os_version:
    name: major_os_version
    description: Specifies the major version number of the required operating system.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:major_os_version
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  minor_os_version:
    name: minor_os_version
    description: Specifies the minor version number of the required operating system.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:minor_os_version
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  major_image_version:
    name: major_image_version
    description: Specifies the major version number of the image.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:major_image_version
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  minor_image_version:
    name: minor_image_version
    description: Specifies the minor version number of the image.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:minor_image_version
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  major_subsystem_version:
    name: major_subsystem_version
    description: Specifies the major version number of the subsystem.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:major_subsystem_version
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  minor_subsystem_version:
    name: minor_subsystem_version
    description: Specifies the minor version number of the subsystem.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:minor_subsystem_version
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  win32_version_value_hex:
    name: win32_version_value_hex
    description: Specifies the reserved win32 version value.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:win32_version_value_hex
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: stix_hex
  size_of_image:
    name: size_of_image
    description: Specifies the size, in bytes, of the image, including all headers,
      as the image is loaded in memory.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size_of_image
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
    minimum_value: 0
  size_of_headers:
    name: size_of_headers
    description: Specifies the combined size of the MS-DOS, PE header, and section
      headers, rounded up a multiple of the value specified in the file_alignment
      header.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size_of_headers
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
    minimum_value: 0
  checksum_hex:
    name: checksum_hex
    description: Specifies the checksum of the PE binary.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:checksum_hex
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: stix_hex
  subsystem_hex:
    name: subsystem_hex
    description: The subsystem, such as a GUI or a device driver, needed to run the
      image.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:subsystem_hex
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: stix_hex
  dll_characteristics_hex:
    name: dll_characteristics_hex
    description: Specifies the flags that characterize the PE binary.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:dll_characteristics_hex
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: stix_hex
  size_of_stack_reserve:
    name: size_of_stack_reserve
    description: Specifies the size of the stack to reserve.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size_of_stack_reserve
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
    minimum_value: 0
  size_of_stack_commit:
    name: size_of_stack_commit
    description: Specifies the size of the stack to commit.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size_of_stack_commit
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
    minimum_value: 0
  size_of_heap_reserve:
    name: size_of_heap_reserve
    description: Specifies the size of the local heap space to reserve.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size_of_heap_reserve
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
    minimum_value: 0
  size_of_heap_commit:
    name: size_of_heap_commit
    description: Specifies the size of the local heap space to commit.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:size_of_heap_commit
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
    minimum_value: 0
  loader_flags_hex:
    name: loader_flags_hex
    description: Specifies the reserved loader flags.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:loader_flags_hex
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: stix_hex
  number_of_rva_and_sizes:
    name: number_of_rva_and_sizes
    description: Specifies the number of data-directory entries in the remainder of
      the optional header.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:number_of_rva_and_sizes
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixWindowsPeOptionalHeader
    range: integer
  hashes:
    name: hashes
    description: A dictionary of hashes of the content, keyed by hash algorithm.
    from_schema: https://w3id.org/lmodel/attack
    rank: 1000
    slot_uri: stix:hashes
    owner: StixWindowsPeOptionalHeader
    domain_of:
    - StixExternalReference
    - StixArtifact
    - StixFile
    - StixX509Certificate
    - StixAlternateDataStream
    - StixWindowsPeSection
    - StixWindowsPeOptionalHeader
    range: StixHashes
    inlined: true
any_of:
- slot_conditions:
    magic_hex:
      name: magic_hex
      required: true
- slot_conditions:
    major_linker_version:
      name: major_linker_version
      required: true
- slot_conditions:
    minor_linker_version:
      name: minor_linker_version
      required: true
- slot_conditions:
    size_of_code:
      name: size_of_code
      required: true
- slot_conditions:
    size_of_initialized_data:
      name: size_of_initialized_data
      required: true
- slot_conditions:
    size_of_uninitialized_data:
      name: size_of_uninitialized_data
      required: true
- slot_conditions:
    address_of_entry_point:
      name: address_of_entry_point
      required: true
- slot_conditions:
    base_of_code:
      name: base_of_code
      required: true
- slot_conditions:
    base_of_data:
      name: base_of_data
      required: true
- slot_conditions:
    image_base:
      name: image_base
      required: true
- slot_conditions:
    section_alignment:
      name: section_alignment
      required: true
- slot_conditions:
    file_alignment:
      name: file_alignment
      required: true
- slot_conditions:
    major_os_version:
      name: major_os_version
      required: true
- slot_conditions:
    minor_os_version:
      name: minor_os_version
      required: true
- slot_conditions:
    major_image_version:
      name: major_image_version
      required: true
- slot_conditions:
    minor_image_version:
      name: minor_image_version
      required: true
- slot_conditions:
    major_subsystem_version:
      name: major_subsystem_version
      required: true
- slot_conditions:
    minor_subsystem_version:
      name: minor_subsystem_version
      required: true
- slot_conditions:
    win32_version_value_hex:
      name: win32_version_value_hex
      required: true
- slot_conditions:
    size_of_image:
      name: size_of_image
      required: true
- slot_conditions:
    size_of_headers:
      name: size_of_headers
      required: true
- slot_conditions:
    checksum_hex:
      name: checksum_hex
      required: true
- slot_conditions:
    subsystem_hex:
      name: subsystem_hex
      required: true
- slot_conditions:
    dll_characteristics_hex:
      name: dll_characteristics_hex
      required: true
- slot_conditions:
    size_of_stack_reserve:
      name: size_of_stack_reserve
      required: true
- slot_conditions:
    size_of_stack_commit:
      name: size_of_stack_commit
      required: true
- slot_conditions:
    size_of_heap_reserve:
      name: size_of_heap_reserve
      required: true
- slot_conditions:
    size_of_heap_commit:
      name: size_of_heap_commit
      required: true
- slot_conditions:
    loader_flags_hex:
      name: loader_flags_hex
      required: true
- slot_conditions:
    number_of_rva_and_sizes:
      name: number_of_rva_and_sizes
      required: true
- slot_conditions:
    hashes:
      name: hashes
      required: true