Imports PEImportListType 0..1 The Imports property characterizes the PE Import Table of the binary. PE_Checksum PEChecksumType 0..1 The PE_Checksum property specifies the checksum of the PE file. Resources PEResourceListType 0..1 The Resources property characterizes the PE Resources of the binary. Sections PESectionListType 0..1 The Sections property characterizes the PE Sections of the binary. Type PEType 0..1 The Type property specifies the particular type of the PE binary, e.g. Executable. PEChecksumType The PEChecksumType class records the checksum of the PE file, both as found in the file and computed. The property table of the PEChecksumType class is given in Table 32. . Properties of the PEChecksumType class Name Type Multiplicity Description PE_Computed_API cyboxCommon: LongObjectPropertyType 0..1 The PE_Computed_API property specifies a checksum computed by an external algorithm. PE_File_API cyboxCommon: LongObjectPropertyType 0..1 The PE_File_API property specifies the checksum computed by IMAGHELP.DLL.
PE_File_Raw cyboxCommon: LongObjectPropertyType 0..1 The PE_File_Raw property specifies the checksum in the PE file (in the Optional Header). PEExportsType Class The PEExportsType class specifies the PE File exports data section. The exports data section contains information about symbols exported by the PE File (a DLL) which can be dynamically loaded by other executables. This class and its components abstract the Windows structures. The UML diagram corresponding to the PEExportsType class is shown in Figure 32. Figure . UML diagram for PEExportsType class The property table of the PEExportsType class is given in Table 33. Table . Properties of the PEExportsType class Name Type Multiplicity Description Name cyboxCommon: StringObjectPropertyType 0..1 The Name property specifies the actual name of the PE module, as used by the PE loader when it is imported by another executable. Exported_Functions PEExportedFunctionsType 0..1 The Exported_Functions property specifies a list of the exported functions in this section. Exports_Time_Stamp cyboxCommon: DateTimeObjectPropertyType 0..1 The Exports_Time_Stamp property specifies the date and time the export data was created. Number_Of_Addresses cyboxCommon: LongObjectPropertyType 0..1 The Number_Of_Addresses property specifies the number of addresses in the export data section's address table.
PEResourceType Class The PEResourceType class is intended as container for the properties relevant to PE binary resources. The property table of the PEResourceType class is given in Table 39. Table . Properties of the PEResourceType class Name Type Multiplicity Description Type PEResourceContentType 0..1 The Type property refers to the type of data referred to by this resource. Name cyboxCommon: StringObjectPropertyType 0..1 The Name property specifies the name of the resource used by the PE binary. Size cyboxCommon: PositiveIntegerObjectPropertyType 0..1 The Size property specifies the size of the resource, in bytes. Virtual_Address cyboxCommon: HexBinaryObjectPropertyType 0..1 The Virtual_Address property specifies the relative virtual address (RVA) of the resource data. Language cyboxCommon: StringObjectPropertyType 0..1 The Language property specifies the name of the language (LANG) defined for the resource, if applicable. Sub_Language cyboxCommon: StringObjectPropertyType 0..1 The Sub_Language property specifies the name of the sub language (SUBLANG) defined for the resource, if applicable. Hashes cyboxCommon:HashListType 0..1 The Hashes property is used to include any hash values computed the specified PE binary resource as input.
Virtual_Address cyboxCommon: HexBinaryObjectPropertyType 0..1 The Virtual_Address property specifies the relative virtual address (RVA) of the PE binary library imported function. The PEImportListType class specifies a list of functions in an import data section. The UML diagram corresponding to the PEImportListType class is shown in . Figure . UML diagram for the PEImportListType class The property table of the PEImportListType class is given in Table 314. . Properties of the PEImportListType class Name Type Multiplicity Description Import PEImportType 1..* The Import property specifies a single property in a list of imported functions. Class The PESectionType is intended as container for the properties relevant to PE binary sections. A PE Section consists of a header and data. The PESectionType contains properties that describe the Section Header and metadata computed about the section (e.g., hashes, entropy). The UML diagram corresponding to the PESectionType class is shown in Figure 35. Figure . UML diagram for the PESectionType class The property table of the PESectionType class is given in Table 315. Table . Properties of the PESectionType class
Name Type Multiplicity Description Section_Header PESectionHeaderStructType 0..1 The Section_Header property contains characteristics of the section's section header structure. Data_Hashes cyboxCommon:HashListType 0..1 The Data_Hashes property is used to include any hash values computed using the data contained in the specified PE binary section as input. Entropy EntropyType 0..1 The Entropy property specifies the calculated entropy of the PE binary section. Header_Hashes cyboxCommon:HashListType 0..1 The Header_Hashes property is used to include any hash values computed using the header of the specified PE binary section as input. The PEDataDirectoryStructType class is intended as container for the properties relevant to a PE binary's data directory structure. The property table of the PEDataDirectoryStructType class is given in Table 316. Table . Properties of the PEDataDirectoryStructType class Name Type Multiplicity Description Virtual_Address cyboxCommon: HexBinaryObjectPropertyType 0..1 The Virtual_Address property specifies the relative virtual address (RVA) of the data structure. Size cyboxCommon: NonNegativeIntegerObjectPropertyType 0..1 The Size property specifies the size of the data structure, in bytes.
e_ovro cyboxCommon: HexBinaryObjectPropertyType 0..1 The e_ovro property specifies the overlay number, which is normally set to 0x0000, because few programs actually have overlays. It changes only in files containing programs that use overlays. See for more information about overlays. reserved1 cyboxCommon: HexBinaryObjectPropertyType 0..4 The reserved1 property specifies reserved words for the program (known in winnt.h as e_res[4]), usually set to zero by the linker. In this case, just use a single reserved1 set to zero; if not zero create four reserved1 with the correct value. e_oemid cyboxCommon: HexBinaryObjectPropertyType 0..1 The e_oemid property specifies the identifier for the OEM for e_oeminfo. e_oeminfo cyboxCommon: HexBinaryObjectPropertyType 0..1 The e_oeminfo property specifies the OEM information for a specific value of e_oeminfo. reserved2 cyboxCommon: HexBinaryObjectPropertyType 0..1 The reserved2 property specifies reserved words for the program (known in winnt.h as e_res[10]), usually set to zero by the linker. In this case, just use a single reserved1 set to zero; if not zero create ten reserved1 with the correct value. e_lfanew cyboxCommon: HexBinaryObjectPropertyType 0..1 The e_lfanew property specifies the file address of the of the new exe header. In particular, it is a 4-byte offset into the file the PE file header is located. It is necessary to use this offset to locate the PE header in the file. Hashes cyboxCommon:HashListType 0..1 The Hashes property is used to include any hash values computed using the specified PE binary MS-DOS header as input.
Hashes cyboxCommon:HashListType 0..1 The Hashes property is used to include any hash values computed using the specified PE binary file header as input. The PEFileHeaderType class refers to the PE file header (sometimes referred to as the COFF header) and its associated characteristics. The property table of the PEFileHeaderType class is given in Table 320. Table . Properties of the PEFileHeaderType class Name Type Multiplicity Description Machine cyboxCommon: HexBinaryObjectPropertyType 0..1 The Machine property specifies the type of target machine. Number_Of_Sections cyboxCommon: NonNegativeIntegerObjectPropertyType 0..1 The Number_Of_Sections property specifies the number of sections in the file. Time_Date_Stamp cyboxCommon: HexBinaryObjectPropertyType 0..1 The Time_Date_Stamp property specifies the time when the file was created (the low 32 bits of the number of seconds epoch). Pointer_To_Symbol_Table cyboxCommon: HexBinaryObjectPropertyType 0..1 The Pointer_To_Symbol_Table property specifies the file offset of the COFF symbol table (should be 0). Number_Of_Symbols cyboxCommon: NonNegativeIntegerObjectPropertyType 0..1 The Number_Of_Symbols property specifies the number of entries in the symbol table (should be 0).
Size_Of_Optional_Header cyboxCommon: HexBinaryObjectPropertyType 0..1 The Size_Of_Optional_Header property specifies the size of the optional header. It should be 0 for object files and non-zero for executables. Characteristics cyboxCommon: HexBinaryObjectPropertyType 0..1 The Characteristics property specifies the flags that indicate the file's characteristics. Hashes cyboxCommon:HashListType 0..1 The Hashes property specifies any hashes computed for the Optional Header. Data Type The SubsystemType data type specifies the subsystem type. Its core value SHOULD be a literal from the SubsystemTypeEnum enumeration. It extends the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications. Data Type The PEType data type specifies the PE file type. Its core value SHOULD be a literal from the PETypeEnum enumeration. It extends the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications. Class The PEOptionalHeaderType describes the PE Optional Header structure. Additional computed metadata, e.g., hashes of the header, are also included. The property table of the PEOptionalHeaderType class is given in Table 321. Table . Properties of the PEOptionalHeaderType class Name Type Multiplicity Description Magic cyboxCommon: 0..1 The Magic property specifies the unsigned integer that indicates the type of executable file.
Base_Of_Data cyboxCommon: HexBinaryObjectPropertyType 0..1 The Base_Of_Data property specifies the address that is relative to the image base of the beginning-of-data section when it is loaded into memory. Image_Base cyboxCommon: HexBinaryObjectPropertyType 0..1 The Image_Base property specifies the preferred address of the byte of image when loaded into memory; must be a multiple of 64 K. Section_Alignment cyboxCommon: HexBinaryObjectPropertyType 0..1 The Section_Alignment property specifies the alignment (in bytes) of sections when they are loaded into memory. File_Alignment cyboxCommon: HexBinaryObjectPropertyType 0..1 The File_Alignment property specifies the factor (in bytes) that is used to align the raw data of sections in the image file. Major_OS_Version cyboxCommon: HexBinaryObjectPropertyType 0..1 The Major_OS_Version property specifies the major version number of the required operating system. Minor_OS_Version cyboxCommon: HexBinaryObjectPropertyType 0..1 The Minor_OS_Version property specifies the minor version number of the required operating system. Major_Image_Version cyboxCommon: HexBinaryObjectPropertyType 0..1 The Major_Image_Version property specifies the major version number of the image. Minor_Image_Version cyboxCommon: HexBinaryObjectPropertyType 0..1 The Minor_Image_Version property specifies the minor version number of the image. Major_Subsystem_Version cyboxCommon: HexBinaryObjectPropertyType 0..1 The Major_Subsystem_Version property specifies the major version number of the subsystem.
Minor_Subsystem_Version cyboxCommon: HexBinaryObjectPropertyType 0..1 The Minor_Subsystem_Version property specifies the minor version number of the subsystem. Win32_Version_Value cyboxCommon: HexBinaryObjectPropertyType 0..1 The Win32_Version_Value property is reserved; must be 0. Size_Of_Image cyboxCommon: HexBinaryObjectPropertyType 0..1 The Size_Of_Image property specifies the size (in of the image, including all headers, as the image is loaded in memory. Size_Of_Headers cyboxCommon: HexBinaryObjectPropertyType 0..1 The Size_Of_Headers property specifies the combined size of the MS DOS header, PE header, and section headers rounded up to a multiple of FileAlignment. Checksum cyboxCommon: HexBinaryObjectPropertyType 0..1 The Checksum property specifies the checksum of the PE file. Subsystem cyboxCommon: HexBinaryObjectPropertyType 0..1 The Subsystem property specifies the subsystem (e.g., GUI, device driver) that is required to run this image. DLL_Characteristics cyboxCommon: HexBinaryObjectPropertyType 0..1 The DLL_Characteristics property specifies flags that characterize the PE file. Size_Of_Stack_Reserve cyboxCommon: HexBinaryObjectPropertyType 0..1 The Size_Of_Stack_Reserve property specifies the size of the stack to reserve. Size_Of_Stack_Commit cyboxCommon: HexBinaryObjectPropertyType 0..1 The Size_Of_Stack_Commit property specifies the size of the stack to commit. Size_Of_Heap_Reserve cyboxCommon: 0..1 The Size_Of_Heap_Reserve property specifies the size of the local heap space to reserve.
HexBinaryObjectPropertyType Size_Of_Heap_Commit cyboxCommon: HexBinaryObjectPropertyType 0..1 The Size_Of_Heap_Commit property specifies the size of the local heap space to commit. Loader_Flags cyboxCommon: HexBinaryObjectPropertyType 0..1 The Loader_Flags property is reserved; must be 0. Number_Of_Rva_And_Sizes cyboxCommon: HexBinaryObjectPropertyType 0..1 The Number_Of_Rva_And_Sizes property specifies the number of data-directory entries in the remainder of the optional header. Data_Directory DataDirectoryType 0..1 The Data_Directory property specifies the data directories in the remainder in the optional header. Hashes cyboxCommon: HashListType 0..1 The Hashes property is used to include any hash values computed using the specified PE binary optional header as input. The DataDirectoryType specifies the data directories that can appear in the PE file's optional header. The data directories, except the Certificate Table, are loaded into memory so they can be used at runtime. The property table of the DataDirectoryType class is given in Table 322. . Properties of the DataDirectoryType class Name Type Multiplicity Description
Bound_Import PEDataDirectoryStructType 0..1 The Bound_Import property specifies the bound import table data directory. Import_Address_Table PEDataDirectoryStructType 0..1 The Import_Address_Table property specifies the import address table (IAT) data directory. Delay_Import_Descriptor PEDataDirectoryStructType 0..1 The Delay_Import_Descriptor property specifies the import descriptor data directory. CLR_Runtime_Header PEDataDirectoryStructType 0..1 The CLR_Runtime_Header property specifies the Common Language Runtime (CLR) header data directory. Reserved PEDataDirectoryStructType 0..1 The Reserved property is reserved; must be 0. Class The PEBuildInformationType class captures information about the tools used to build the PE binary, including the compiler and linker. The property table of the PEBuildInformationType class is given in Table 323. Table . Properties of the PEBuildInformationType class Name Type Multiplicity Description Linker_Name cyboxCommon: StringObjectPropertyType 0..1 The Linker_Name property specifies the name of the linker used to link the PE binary. Linker_Version cyboxCommon: StringObjectPropertyType 0..1 The Linker_Version property specifies the version of the linker used to link the PE binary.
Compiler_Name cyboxCommon: StringObjectPropertyType 0..1 The Compiler_Name property specifies the name of the compiler used to compile the binary. Compiler_Version cyboxCommon: StringObjectPropertyType 0..1 The Compiler_Version property specifies the version of the compiler used to compile the binary. Data Type The PEResourceContentType data type specifies the PE resource type. Its core value SHOULD be a literal from the PEResourceTypeEnum enumeration. It extends the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications. Enumeration The literals of the SubsystemTypeEnum enumeration are in Table 324. Table . Literals of the SubsystemTypeEnum enumeration Enumeration Literal Description Unknown Specifies an unknown subsystem. Native Specifies that no subsystem is required to run the image (i.e. only device drivers and native system processes are needed). Windows_GUI Specifies the Windows Graphical user interface (GUI) subsystem. Windows_CUI Specifies the Windows character-mode user interface (CUI) subsystem. OS2_CUI Specifies the OS/2 CUI subsystem.
Acknowledgments The following individuals have participated in the creation of this specification and are gratefully acknowledged: Aetna Crawford AIT Austrian Institute of Technology Roman Fiedler Florian Skopik Australia and New Zealand Banking Group (ANZ Bank) Dean Thompson Blue Coat Systems, Inc. Owen Johnson Bret Jordan Century Link Cory Kennedy CIRCL Alexandre Dulaunoy Andras Iklody Raphaël Vinot Citrix Systems Joey Peloquin Dell Will Urbanski Jeff Williams DTCC Dan Brown Gordon Hundley Chris Koutras EMC Robert Griffin Jeff Odom Ravi Sharda Financial Services Information Sharing and Analysis Center (FS-ISAC) David Eilken Chris Ricard Fortinet Inc. Gavin Chow Airbus SAS Joerg Eschweiler Marcos Orallo Anomali Ryan Clough Wei Huang Hugh Njemanze Pelusi Aaron Shelmire Jason Trost Bank of America Alexander Foley Center for Internet Security (CIS) Sarah Kelley Point Software Technologies Ron Davidson Cisco Systems Syam Appala Ted Bedwell David McGrew Pavan Reddy Omar Santos Jyoti Verma Threat Intelligence Network, Inc. (CTIN) Doug DePeppe Jane Ginn Ben Othman DHS Office of Cybersecurity and Communications (CS&C) Richard Struse Marlon Taylor EclecticIQ Marko Dragoljevic Joep Gommers Sergey Polzunov
Kenichi Terashita Fujitsu Limited Neil Edwards Frederick Hirsch Ryusuke Masuoka Daisuke Murabayashi Google Inc. Mark Risher Hitachi, Ltd. Noguchi Akihito Sawada Masato Terada iboss, Inc. Paul Martini Individual Jerome Athias Peter Brown Jones Sanjiv Kalkar Bar Lockwood Terry MacDonald Alex Intel Corporation Tim Casey Kent Landfield JPMorgan Chase Bank, N.A. Terrence Driscoll David Laurance LookingGlass Allan Thomson Lee Vorthman Mitre Corporation Greg Back Jonathan Baker Sean Barnum Desiree Beck Nicole Gong Jasen Jacobsen Ivan Kirillov Richard Piazza Jon Salwen Rutger Andrei Sîrghi Raymon van der Velde eSentire, Inc. Jacob Gajek FireEye, Inc. Phillip Pavan Gorakav Anuj Kumar Shyamal Pandya Paul Patrick Scott Shreve Fox-IT Brown Georgetown University Eric Burger Hewlett Packard Enterprise (HPE) Tomas Sander IBM Peter Allor Eldan Ben-Haim Sandra Hernandez Keirstead John Morris Rusu Ron Williams IID Chris Richardson Integrated Networking Technologies, Inc. Patrick Maroney Johns Hopkins University Applied Physics Laboratory Karin Marr Julie Modlin Mark Moss Pamela Kaiser Permanente Russell Culpepper Beth Pumo Lumeta Corporation Brandon Hoffman MTG Management Consultants, LLC.
Charles Schmidt Emmanuelle Vargas-Gonzalez John Wunder National Council of ISACs (NCI) Scott Algeier Denise Anderson Josh Poster NEC Corporation Takahiro Kakumaru American Energy Standards Board Darnell Object Management Group Cory Casanave Palo Alto Networks Vishaal Hariprasad Queralt, Inc. John Tolbert Resilient Systems, Inc. Ted Julian Securonix Igor Baikalov Siemens AG Bernd Grobauer Soltra John Anderson Aishwarya Asok Kumar Peter Ayasse Jeff Beekman Michael Butt Cynthia Camacho Aharon Chernin Mark Clancy Brady Cotton Trey Darley Mark Davidson Paul Dion Daniel Dye Robert Raymond Keckler Ali Khan Chris Kiehl James Cabral National Security Agency Mike Boyle Jessica New Context Services, Inc. John-Mark Gurney Christian Hunt James Moler Daniel Riedel Andrew Storms OASIS James Bryce Clark Cover Chet Ensign Open Identity Exchange Don Thibeau PhishMe Inc. Josh Larkins Raytheon Company-SAS Daniel Wyschogrod Retail Cyber Intelligence Sharing Center Brian Engle Semper Fortis Solutions Joseph Brand Splunk Inc. Cedric LeRoux Brian Luger Wang Greg Reaume Alan Steer Threat Intelligence Pty Ltd Tyron Miller Andrew van der ThreatConnect, Inc. Wade Baker Cole Iliff Andrew Pendergast Ben Schmoker Jason Spies TruSTAR Technology
Clayton Long Michael Pepin Natalie Suarez Waters Benjamin Yates Symantec Corp. Curtis Kostrosky The Boeing Company Crystal Hayes ThreatQuotient, Inc. Ryan Trost U.S. Bank Mark Angel Brad Butts Brian Fay Mona Magathan Yevgen Sautin US Department of Defense (DoD) James Bohling Eoghan Casey Gary Katz Jeffrey Mates VeriSign Robert Coderre Kyle Maxwell Eric Osterweil Chris Roblee United Kingdom Cabinet Office Iain Brown Adam Cooper Mike McLellan Chris O’Brien James Penman Howard Staple Taylor Laurie Thomson Alastair Treharne Julian White Bethany Yates US Department of Homeland Security Evette Maynard-Noel Justin Stekervetz ViaSat, Inc. Lee Chieffalo Wilson Figueroa Andrew May Yaana Technologies, LLC Anthony Rutkowski The authors also like to thank the larger CybOX Community for its input and help in reviewing this document.