home

istal.exe

Philips Medical Systems Cleveland, Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ISTAL’.
Publisher:
Philips Medical Systems Cleveland, Inc.  (signed and verified)

MD5:
34d96ba4934e5ef6a016b3aa008d9f67

SHA-1:
6d63389178dcfb70b86641fb3d8837c4c33c4ce4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/17/2025 4:51:34 AM UTC  (today)

File size:
88.7 KB (90,872 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\philips\ist\istal.exe

Digital Signature
Signed by:
Philips Medical Systems Cleveland, Inc.

Authority:
VeriSign, Inc.

Valid from:
8/19/2013 7:00:00 PM

Valid to:
8/19/2016 6:59:59 PM

Subject:
CN="Philips Medical Systems Cleveland, Inc.", OU=Global Customer Support, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Philips Medical Systems Cleveland, Inc.", L=Cleveland, S=Ohio, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
197AD65417DF1B8E0D9EEF35AA0DEB2B

File PE Metadata
Compilation timestamp:
12/7/2015 12:27:44 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
1536:nA6hcnp5ZPk9FzSxAbUxxzDhXUbbghZn1uXFpFbPdE+f0:nWnfZPiMxxpK8Pn1uXFpFbPdE+f0

Entry address:
0x4A61

Entry point:
E8, A9, 71, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, A3, 4C, 53, 41, 00, 5D, C3, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A1, 48, 40, 41, 00, 33, C5, 89, 45, FC, 53, 8B, 5D, 08, 57, 83, FB, FF, 74, 07, 53, E8, 0B, 72, 00, 00, 59, 83, A5, E0, FC, FF, FF, 00, 6A, 4C, 8D, 85, E4, FC, FF, FF, 6A, 00, 50, E8, F9, E9, FF, FF, 8D, 85, E0, FC, FF, FF, 89, 85, D8, FC, FF, FF, 8D, 85, 30, FD, FF, FF, 83, C4, 0C, 89, 85, DC, FC, FF, FF, 89, 85, E0, FD, FF, FF, 89, 8D, DC, FD, FF, FF, 89, 95, D8...
 
[+]

Entropy:
6.4420

Code size:
60 KB (61,440 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
ISTAL

Command:
C:\Program Files\philips\ist\istal.exe


Scan istal.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.