Heads up! These docs are for STIX 1.1.1, which is not the latest version (1.2). View the latest!

PESectionHeaderStructTypeWin Executable File Object Schema

The PESectionHeaderStruct type is intended as container for the properties relevant to a PE binary's section header structure.


Fields

Field Name Type Description
Name0..1 StringObjectPropertyType

The Name field specifies the name of the PE binary section.

Virtual_Size0..1 HexBinaryObjectPropertyType

The Virtual_Size field is the total size of the PE binary section when loaded into memory. It is valid only for executables and should be 0 for object files.

Virtual_Address0..1 HexBinaryObjectPropertyType

The Virtual_Address field specifies the relative virtual address (RVA) of the PE binary section.

Size_Of_Raw_Data0..1 HexBinaryObjectPropertyType

The Size_Of_Raw_Data field specifies the size of the data contained in the PE binary section.

Pointer_To_Raw_Data0..1 HexBinaryObjectPropertyType

The Pointer_To_Raw_Data field specifies the file offset of the beginning of the PE binary section.

Pointer_To_Relocations0..1 HexBinaryObjectPropertyType

The Pointer_To_Relocations field specifies the offset of the PE binary section relocations, if applicable.

Pointer_To_Linenumbers0..1 HexBinaryObjectPropertyType

Specifies the beginning of line-number entries for the section. Should be 0.

Number_Of_Relocations0..1 NonNegativeIntegerObjectPropertyType

The Number_Of_Relocations field specifies the number of relocations defined for the specified PE binary section.

Number_Of_Linenumbers0..1 NonNegativeIntegerObjectPropertyType

Specifies the number of line number entries for the section. Should be 0.

Characteristics0..1 HexBinaryObjectPropertyType

The Characteristics field specifies any flags defined for the specified PE binary section.