https://github.com/CybOXProject/schemas/blob/master/objects/Win_Executable_File_Object.xsd#L612 The DOS Header overlay number in the schema reads `e_ovro` It should read `e_ovno` Reference: http://www.csn.ul.ie/~caolan/pub/winresdump/winresdump/doc/pefile2.html