struct

ECS::LogEntry::Dll::Pe

Inherits JSON::Serializable < Struct < Value < Object

Constructors

new(pull : JSON::PullParser)
Source
new

Initialize all values as nil

Source
new(*, __pull_for_json_serializable pull : JSON::PullParser)
Source

Instance methods

architecture(new_value : String)

A chainable setter for architecture

Source
architecture

dll.pe.architecture

CPU architecture target for the file.

Level: Extended Type: Keyword Example:

x64
Source
architecture=(architecture : String | Nil)

dll.pe.architecture

CPU architecture target for the file.

Level: Extended Type: Keyword Example:

x64
Source
company(new_value : String)

A chainable setter for company

Source
company

dll.pe.company

Internal company name of the file, provided at compile-time.

Level: Extended Type: Keyword Example:

Microsoft Corporation
Source
company=(company : String | Nil)

dll.pe.company

Internal company name of the file, provided at compile-time.

Level: Extended Type: Keyword Example:

Microsoft Corporation
Source
description(new_value : String)

A chainable setter for description

Source
description

dll.pe.description

Internal description of the file, provided at compile-time.

Level: Extended Type: Keyword Example:

Paint
Source
description=(description : String | Nil)

dll.pe.description

Internal description of the file, provided at compile-time.

Level: Extended Type: Keyword Example:

Paint
Source
file_version(new_value : String)

A chainable setter for file_version

Source
file_version

dll.pe.file_version

Internal version of the file, provided at compile-time.

Level: Extended Type: Keyword Example:

6.3.9600.17415
Source
file_version=(file_version : String | Nil)

dll.pe.file_version

Internal version of the file, provided at compile-time.

Level: Extended Type: Keyword Example:

6.3.9600.17415
Source
imphash(new_value : String)

A chainable setter for imphash

Source
imphash

dll.pe.imphash

A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.

Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.

Level: Extended Type: Keyword Example:

0c6803c4e922103c4dca5963aad36ddf
Source
imphash=(imphash : String | Nil)

dll.pe.imphash

A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.

Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.

Level: Extended Type: Keyword Example:

0c6803c4e922103c4dca5963aad36ddf
Source
original_file_name(new_value : String)

A chainable setter for original_file_name

Source
original_file_name

dll.pe.original_file_name

Internal name of the file, provided at compile-time.

Level: Extended Type: Keyword Example:

MSPAINT.EXE
Source
original_file_name=(original_file_name : String | Nil)

dll.pe.original_file_name

Internal name of the file, provided at compile-time.

Level: Extended Type: Keyword Example:

MSPAINT.EXE
Source
product(new_value : String)

A chainable setter for product

Source
product

dll.pe.product

Internal product name of the file, provided at compile-time.

Level: Extended Type: Keyword Example:

Microsoft® Windows® Operating System
Source
product=(product : String | Nil)

dll.pe.product

Internal product name of the file, provided at compile-time.

Level: Extended Type: Keyword Example:

Microsoft® Windows® Operating System
Source