observable:WindowsPEOptionalHeader leaf node

sh:Shape
- observable:WindowsPEOptionalHeader

URI

https://unifiedcyberontology.org/ontology/uco/observable#WindowsPEOptionalHeader

Label

WindowsPEOptionalHeader

Description

A Windows PE optional header is a grouping of characteristics unique to the 'optional header' of a Windows PE (Portable Executable) file, consisting of a collection of metadata about the executable code structure of the file.

Target Classes (1)

observable:WindowsPEOptionalHeader

Shape Properties

Instances of observable:WindowsPEOptionalHeader can have the following properties:

PROPERTY	MIN COUNT	MAX COUNT	TYPE
observable:WindowsPEOptionalHeader
observable:addressOfEntryPoint	0	*	xsd:unsignedInt
observable:baseOfCode	0	*	xsd:unsignedInt
observable:checksum	0	*	xsd:unsignedInt
observable:dllCharacteristics	0	*	xsd:unsignedShort
observable:fileAlignment	0	*	xsd:unsignedInt
observable:imageBase	0	*	xsd:unsignedInt
observable:loaderFlags	0	*	xsd:unsignedInt
observable:magic	0	*	xsd:unsignedShort
observable:majorImageVersion	0	*	xsd:unsignedShort
observable:majorLinkerVersion	0	*	xsd:byte
observable:majorOSVersion	0	*	xsd:unsignedShort
observable:majorSubsystemVersion	0	*	xsd:unsignedShort
observable:minorImageVersion	0	*	xsd:unsignedShort
observable:minorLinkerVersion	0	*	xsd:byte
observable:minorOSVersion	0	*	xsd:unsignedShort
observable:minorSubsystemVersion	0	*	xsd:unsignedShort
observable:numberOfRVAAndSizes	0	*	xsd:unsignedInt
observable:sectionAlignment	0	*	xsd:unsignedInt
observable:sizeOfCode	0	*	xsd:unsignedInt
observable:sizeOfHeaders	0	*	xsd:unsignedInt
observable:sizeOfHeapCommit	0	*	xsd:unsignedInt
observable:sizeOfHeapReserve	0	*	xsd:unsignedInt
observable:sizeOfImage	0	*	xsd:unsignedInt
observable:sizeOfInitializedData	0	*	xsd:unsignedInt
observable:sizeOfStackCommit	0	*	xsd:unsignedInt
observable:sizeOfStackReserve	0	*	xsd:unsignedInt
observable:sizeOfUninitializedData	0	*	xsd:unsignedInt
observable:subsystem	0	*	xsd:unsignedShort
observable:win32VersionValue	0	*	xsd:unsignedInt

Implementation

@prefix observable: <https://unifiedcyberontology.org/ontology/uco/observable#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

observable:WindowsPEOptionalHeader a owl:Class,
        sh:NodeShape ;
    rdfs:label "WindowsPEOptionalHeader"@en ;
    rdfs:comment "A Windows PE optional header is a grouping of characteristics unique to the 'optional header' of a Windows PE (Portable Executable) file, consisting of a collection of metadata about the executable code structure of the file."@en ;
    sh:property [ sh:datatype xsd:byte ;
            sh:nodeKind sh:Literal ;
            sh:path observable:majorLinkerVersion ],
        [ sh:datatype xsd:byte ;
            sh:nodeKind sh:Literal ;
            sh:path observable:minorLinkerVersion ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:addressOfEntryPoint ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:baseOfCode ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:checksum ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:fileAlignment ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:imageBase ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:loaderFlags ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:numberOfRVAAndSizes ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sectionAlignment ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfCode ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfHeaders ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfHeapCommit ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfHeapReserve ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfImage ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfInitializedData ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfStackCommit ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfStackReserve ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:sizeOfUninitializedData ],
        [ sh:datatype xsd:unsignedInt ;
            sh:nodeKind sh:Literal ;
            sh:path observable:win32VersionValue ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:dllCharacteristics ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:magic ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:majorImageVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:majorOSVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:majorSubsystemVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:minorImageVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:minorOSVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:minorSubsystemVersion ],
        [ sh:datatype xsd:unsignedShort ;
            sh:nodeKind sh:Literal ;
            sh:path observable:subsystem ] ;
    sh:targetClass observable:WindowsPEOptionalHeader .