Incorrect Authenticode hash calculation for certain files
Author: dinhngtuCreated Sep 18, 2026Updated Sep 18, 2026
Brief description of your issue
PE Viewer calculates the incorrect Authenticode hash for certain PE files.
This particular file has been created as a WiX Toolset custom action binary.
Steps to reproduce (optional)
Download and extract the attached xeninst.CA.dll.zip
Calculate the Authenticode hash using PE Viewer
Expected behavior (optional)
The result agrees with Get-AppLockerFileInformation:
> Get-AppLockerFileInformation .\\\xeninst.CA.dll | fl
Path : E:\DOWNLOADS\XCPNG-WINPV-9.2.385.0-RELEASE-X64 (1)\COMPONENTS\DRIVERINSTALLCUSTOMACTION\XENINST.CA.DLL
Publisher :
Hash : SHA256 0xDC641B9BAA4B161B1ED29BA0B4BF1677183C03FE3864A064DB81F096F738986C
AppX : FalseActual behavior (optional)
The incorrect hash is produced.
14, Authentihash (SHA-256), B9F03E9E1C78FEA20BFC7DD8793D23EA38B959A784FC1F0C7F8C2529DB5D9B71Environment (optional)
System Informer 4.0.26241.138 (99a0d28e) Release (02:38:00 29/08/2026)
Windows 11 26200.9457Source: winsiderss/systeminformer