Heads up! These docs are for STIX 1.1.1, which is not the latest version (1.2). View the latest!

PEFileHeaderTypeWin Executable File Object Schema

The PEFileHeaderType type refers to the PE file header (sometimes referred to as the COFF header) and its associated characteristics.


Fields

Field Name Type Description
Machine0..1 HexBinaryObjectPropertyType

Specifies the type of target machine.

Number_Of_Sections0..1 NonNegativeIntegerObjectPropertyType

Specifies the number of sections in the file.

Time_Date_Stamp0..1 HexBinaryObjectPropertyType

Specifies the time when the file was created (the low 32 bits of the number of seconds since epoch).

Pointer_To_Symbol_Table0..1 HexBinaryObjectPropertyType

Specifies the file offset of the COFF symbol table (should be 0).

Number_Of_Symbols0..1 NonNegativeIntegerObjectPropertyType

Specifies the number of entries in the symbol table. Should be 0.

Size_Of_Optional_Header0..1 HexBinaryObjectPropertyType

Specifies the size of the optional header. Should be 0 for object files and non-zero for executables.

Characteristics0..1 HexBinaryObjectPropertyType

Specifies the flags that indicate the file's characteristics.

Hashes0..1 HashListType

Any hashes computed for the Optional Header.