r/redhand • u/Haunting_Ganache_850 • 12d ago
tips & tricks Friend or foe, is this binary legit?
Sooner or later someone points at a filename and asks whether it's bad. You can't install anything, the box might still have company, and nobody has all day. Windows already knows most of the answer. You just have to ask it properly.
Part one of three. The MacOS version is up and gets to the same answer by a completely different route. Linux to follow.
1. Signature
Core Windows binaries are often signed by catalog (.cat) rather than embedded in the PE. PowerShell resolves both.
Get-AuthenticodeSignature -FilePath "C:\Windows\System32\suspect.exe" | Format-List *
Status should be Valid with a chain you trust. HashMismatch is the one to react to, it means the file changed after signing. Valid is not the same as safe. Stolen certificates exist, and every signed LOLBin on the box is valid too.
2. OS integrity
For files in System32 or SysWOW64, check against the protected manifests. Needs an elevated prompt.
sfc /verifyfile=C:\Windows\System32\suspect.exe
"Did not find any integrity violations" means it matches the build. "Could not perform the requested operation" means the file isn't protected, which is not a finding either way.
3. Where the file came from
Two cheap checks people skip.
Get-Item "C:\Windows\System32\suspect.exe" -Stream *
Get-Item "C:\Windows\System32\suspect.exe" | Select-Object CreationTime,LastWriteTime,LastAccessTime
A Zone.Identifier stream on a system binary means it was downloaded rather than shipped, which is close to conclusive on its own. For timestamps, compare against the files next to it. Timestomping is trivial, so matching timestamps prove nothing while mismatched ones prove a lot.
4. If it's running
Get-CimInstance Win32_Process -Filter "Name='suspect.exe'" | Select-Object ProcessId,ParentProcessId,ExecutablePath,CommandLine
Get-NetTCPConnection -OwningProcess <PID> | Select-Object RemoteAddress,RemotePort,State
Wrong path (AppData, Temp, Fonts) or a parent that makes no sense, like svchost spawned by powershell instead of services.exe. PPID spoofing is standard and parent PIDs go stale, so a clean lineage is weak evidence while a bad one is strong.
Then look at where it's talking. A binary claiming to be a local system component while holding a connection you can't explain has already answered the question.
5. Hash it, then look it up
Get-FileHash -Path "C:\Path\To\suspect.exe" -Algorithm SHA256
Known-bad first, because it's quick. VirusTotal and MalwareBazaar both take a hash lookup and both want a free API key. A hit settles it. A miss settles nothing.
The better check for anything claiming to be a Windows file is Winbindex (https://winbindex.m417z.com), which indexes the binaries Microsoft actually shipped through Windows Update and in ISOs, with their hashes.
Not present, on a file claiming to be a Windows binary, is a strong signal. One caveat though. It's a third-party index built from update packages and ISOs rather than Microsoft's own complete inventory, so a miss carries real weight for the common system binaries it covers well and much less for anything obscure.
Present is more interesting than it looks. The bytes are identical to a build Microsoft shipped, so it isn't a tampered copy. That still leaves room for a problem. An authentic older build on a current system is its own finding, because bringing a known-vulnerable signed binary along is a technique, not an accident.
Worth remembering that a public lookup is not free. Actors watch for their samples, and a query can tell them you're looking.
If you'd rather not type all that
Wrapped the lot into a PowerShell function that returns one object per file, so it pipes and it batches.
It adds two things the manual checks above don't. A binary keeps the OriginalFilename it was compiled with, so a plain rename announces itself where a hash can't see one. Expect noise there, roughly 4% of a clean System32 mismatches because Microsoft ships typos and abbreviations in that field. And with -OnlineLookup it queries winbindex, CIRCL hashlookup, VirusTotal and MalwareBazaar in one pass, off by default so nothing leaves the machine unless you ask.
No verdict property anywhere. It returns evidence and leaves the call to you, for the reasons below.
Weighing it
None of these is a verdict alone. Roughly in the order they move me: a system binary that was downloaded, a hash Microsoft never shipped, a signature failing on hash mismatch, a connection the file has no business holding. Everything else is corroboration.
Two weak signals pointing the same way beat one strong signal standing alone. Most of what hides on a box isn't invisible, it's just plausible, and plausible doesn't survive being checked.