observable:WindowsPEBinaryFileFacet leaf node


URI

https://unifiedcyberontology.org/ontology/uco/observable#WindowsPEBinaryFileFacet

Label

WindowsPEBinaryFileFacet

Description

Properties specific to Windows portable executable (PE) files.

Superclasses (1)

Usage

Instances of observable:WindowsPEBinaryFileFacet can have the following properties:

PROPERTYTYPEDESCRIPTIONRANGE
From class observable:WindowsPEBinaryFileFacet
observable:characteristics owl:DatatypeProperty Specifies the flags that indicate the file’s characteristics. xs:unsignedShort
observable:impHash owl:DatatypeProperty Specifies the special import hash, or ‘imphash’, calculated for the PE Binary based on its imported libraries and functions. xs:string
observable:machine owl:DatatypeProperty Specifies the type of target machine. xs:string
observable:numberOfSections owl:DatatypeProperty Specifies the number of sections in the PE binary, as a non-negative integer. xs:integer
observable:numberOfSymbols owl:DatatypeProperty Specifies the number of entries in the symbol table of the PE binary, as a non-negative integer. xs:integer
observable:peType owl:DatatypeProperty Specifies the type of the PE binary. xs:string
observable:pointerToSymbolTable owl:DatatypeProperty Specifies the file offset of the COFF symbol table. xs:hexBinary
observable:sizeOfOptionalHeader owl:DatatypeProperty Specifies the size of the optional header of the PE binary. xs:integer
observable:timeDateStamp owl:DatatypeProperty Specifies the time when the PE binary was created. xs:dateTime
observable:fileHeaderHashes owl:ObjectProperty Specifies any hashes that were computed for the file header. types:Hash
observable:optionalHeader owl:ObjectProperty Specifies the PE optional header of the PE binary. observable:WindowsPEOptionalHeader
observable:sections owl:ObjectProperty Specifies metadata about the sections in the PE file. observable:WindowsPESection
From class owl:Thing
observable:pictureType owl:DatatypeProperty The type of a picture, for example a thumbnail. xs:string
observable:thumbprintHash owl:ObjectProperty A hash calculated on the entire certificate including signature. types:Hash

Implementation

@prefix observable: <https://unifiedcyberontology.org/ontology/uco/observable#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix uco-core: <https://unifiedcyberontology.org/ontology/uco/core#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

observable:WindowsPEBinaryFileFacet a owl:Class ;
    rdfs:label "WindowsPEBinaryFileFacet"@en ;
    rdfs:comment "Properties specific to Windows portable executable (PE) files."@en ;
    rdfs:subClassOf [ a owl:Restriction ;
            owl:maxCardinality "1"^^xsd:nonNegativeInteger ;
            owl:onProperty observable:peType ],
        [ a owl:Restriction ;
            owl:maxCardinality "1"^^xsd:nonNegativeInteger ;
            owl:onProperty observable:timeDateStamp ],
        [ a owl:Restriction ;
            owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ;
            owl:onClass observable:WindowsPEOptionalHeader ;
            owl:onProperty observable:optionalHeader ],
        [ a owl:Restriction ;
            owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ;
            owl:onDataRange xsd:integer ;
            owl:onProperty observable:numberOfSections ],
        [ a owl:Restriction ;
            owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ;
            owl:onDataRange xsd:integer ;
            owl:onProperty observable:numberOfSymbols ],
        [ a owl:Restriction ;
            owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ;
            owl:onDataRange xsd:integer ;
            owl:onProperty observable:sizeOfOptionalHeader ],
        [ a owl:Restriction ;
            owl:maxQualifiedCardinality "1"^^xsd:nonNegativeInteger ;
            owl:onDataRange xsd:string ;
            owl:onProperty observable:impHash ],
        uco-core:Facet .