PropertyValue
http://www.w3.org/1999/02/22-rdf-syntax-ns#type
http://www.w3.org/ns/prov#value
  • Having retrieved the samples (the author having posted the malware samples on a public website!!!) it appears a few extra settings were required, in particular, one of the samples was a email stored as MIME but the 'decode MIME' option wasn't turned on.
http://www.w3.org/ns/prov#wasQuotedFrom
  • sophos.com