| Previous | Next |
| STATUS_FILE_SYSTEM_LIMITATION | STATUS_NOT_CAPABLE |
STATUS_INVALID_IMAGE_HASH
Code Integrity rejected the image hash
This status is returned when Windows cannot validate an executable image against the trust material and policy applied to that load. Causes include modified file contents, an invalid embedded signature, a missing or mismatched catalog member, an explicitly disallowed hash, or corruption while the file is stored or transferred.
The Authenticode image hash is calculated with PE-specific exclusions, so a general whole-file hash may differ without explaining the policy result. Diagnosis should reproduce validation on the original bytes and correlate it with Code Integrity events that identify the file, signer, policy, and rejection reason.
What to inspect
- Preserve the exact file and calculate both a conventional digest and the Authenticode-aware verification result.
- Run signature and catalog verification with revocation checking under the same account and network conditions.
- Review Code Integrity and App Control logs for the policy ID, signer rule, and hash recorded at load time.
- Replace the binary only from a trusted package; do not disable integrity enforcement to accept an unexplained mismatch.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: verifying the signature of a PE file
- Microsoft: App Control file rule and Authenticode hashes
- Microsoft: Code Integrity event log messages
Looking for a different code? Search another status or error code.