misp-objects/objects/pe/definition.json

125 lines
3.5 KiB
JSON
Raw Normal View History

2017-03-09 14:14:36 +01:00
{
2017-07-03 12:17:46 +02:00
"requiredOneOf": [
"text",
"original-filename",
2017-07-21 11:33:38 +02:00
"internal-filename",
"entrypoint-address"
2017-07-03 12:17:46 +02:00
],
2017-03-09 14:14:36 +01:00
"attributes": {
"pehash": {
2017-08-29 13:25:58 +02:00
"description": "Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/",
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "pehash"
},
2017-03-15 11:30:54 +01:00
"impfuzzy": {
2017-08-29 13:25:58 +02:00
"description": "Fuzzy Hash (ssdeep) calculated from the import table",
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "impfuzzy"
2017-03-15 11:30:54 +01:00
},
2017-07-03 12:17:46 +02:00
"internal-filename": {
2017-08-29 13:25:58 +02:00
"description": "InternalFilename in the resources",
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "filename"
},
"original-filename": {
2017-08-29 13:25:58 +02:00
"description": "OriginalFilename in the resources",
2017-07-03 16:44:11 +02:00
"ui-priority": 1,
2017-07-03 12:17:46 +02:00
"misp-attribute": "filename"
},
"number-sections": {
2017-08-29 13:25:58 +02:00
"description": "Number of sections",
2017-03-14 15:57:05 +01:00
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "counter"
},
"text": {
2017-08-29 13:25:58 +02:00
"description": "Free text value to attach to the PE",
2017-07-03 12:17:46 +02:00
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 1,
2017-08-29 13:25:58 +02:00
"misp-attribute": "text",
"recommended": false
2017-07-03 12:17:46 +02:00
},
"type": {
2017-08-29 13:25:58 +02:00
"description": "Type of PE",
2017-03-14 15:57:05 +01:00
"sane_default": [
"exe",
"dll",
"driver",
"unknown"
2017-07-03 12:17:46 +02:00
],
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 1,
2017-07-03 12:17:46 +02:00
"misp-attribute": "text"
2017-03-09 14:14:36 +01:00
},
2017-07-03 12:17:46 +02:00
"imphash": {
2017-08-29 13:25:58 +02:00
"description": "Hash (md5) calculated from the import table",
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "imphash"
2017-03-09 14:14:36 +01:00
},
"compilation-timestamp": {
2017-08-29 13:25:58 +02:00
"description": "Compilation timestamp defined in the PE header",
2017-07-03 16:44:11 +02:00
"ui-priority": 1,
2017-07-03 12:17:46 +02:00
"misp-attribute": "datetime"
2017-03-09 14:14:36 +01:00
},
2017-08-29 13:25:58 +02:00
"entrypoint-section-at-position": {
"description": "Name of the section and position of the section in the PE",
2017-07-03 12:17:46 +02:00
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "text"
2017-03-09 14:14:36 +01:00
},
"entrypoint-address": {
2017-08-29 13:25:58 +02:00
"description": "Address of the entry point",
2017-07-03 12:17:46 +02:00
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "text"
2017-03-09 14:14:36 +01:00
},
"file-description": {
2017-08-29 13:25:58 +02:00
"description": "FileDescription in the resources",
2017-07-03 12:17:46 +02:00
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "text"
2017-03-09 14:14:36 +01:00
},
"file-version": {
2017-08-29 13:25:58 +02:00
"description": "FileVersion in the resources",
2017-07-03 12:17:46 +02:00
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "text"
2017-03-09 14:14:36 +01:00
},
"lang-id": {
2017-08-29 13:25:58 +02:00
"description": "Lang ID in the resources",
2017-07-03 12:17:46 +02:00
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "text"
2017-03-09 14:14:36 +01:00
},
"product-name": {
2017-08-29 13:25:58 +02:00
"description": "ProductName in the resources",
2017-07-03 12:17:46 +02:00
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "text"
2017-03-09 14:14:36 +01:00
},
"product-version": {
2017-08-29 13:25:58 +02:00
"description": "ProductVersion in the resources",
2017-07-03 12:17:46 +02:00
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "text"
2017-03-12 23:06:39 +01:00
},
"company-name": {
2017-08-29 13:25:58 +02:00
"description": "CompanyName in the resources",
2017-07-03 12:17:46 +02:00
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "text"
2017-03-12 23:06:39 +01:00
},
"legal-copyright": {
2017-08-29 13:25:58 +02:00
"description": "LegalCopyright in the resources",
2017-07-03 12:17:46 +02:00
"disable_correlation": true,
2017-07-03 16:44:11 +02:00
"ui-priority": 0,
2017-07-03 12:17:46 +02:00
"misp-attribute": "text"
2017-03-09 14:14:36 +01:00
}
},
2017-08-29 13:25:58 +02:00
"version": 2,
2017-07-03 12:17:46 +02:00
"description": "Object describing a Portable Executable",
"meta-category": "file",
"uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"name": "pe"
2017-03-09 14:14:36 +01:00
}