Incorrect checksum

ID PE116 Level CRITICAL Category Security

Description

The executable checksum does not match its expected checksum value.

Mitigation

  • Do not modify the executable after building it. If doing so, make sure the software you use for modifications updates the executable checksum.

If using Visual C++:

  • Make sure you pass the /RELEASE option in the linker command line when building the executable.

Arguments

This rule has the following output arguments:

  • checksum - Existing executable checksum value
  • expected_checksum - Expected executable checksum value