How to Check whether an Executable File is Safe or not?

An executable (.exe) file is a file or program that is executable by Microsoft Windows operating systems. However, people often face different issues with executable files like,

• Maximum GPU or CPU usage without executing the .exe file.
• A cleaning utility marks a particular executable file as harmful.

Such issues lead people to think – Whether a particular executable file is harmful to the system or not? That’s what we are going to cover here today. So, if you also want to know how to check whether an executable file is safe or not, then you’ve arrived at the right place.

Why is it Necessary to Check the Authenticity of an Executable File?

Cyber thieves often use executable files to inject malware into the system. Because sometimes, cyber thieves deliberately give their processes the same name for injecting trojan or malware into a system. The infected executable files often use extensive system resources without activating them and if that’s your case, then removing those files should be your priority.

However, executable files are not always infected. So, it’s best to check the authenticity of any executable file that looks suspicious to you.

Steps for how to Verify / Authenticate:

There are various ways to check the authenticity of an executable file. Some people use a third-party application. However, if some file is from Microsoft, then that file should have Microsoft’s digital signatures. So, we’ll check for Microsoft’s digital signatures.

Note: Here, we have picked the ‘SearchApp.exe’ file as a sample. But, you can pick any executable file and apply the same procedure there as well

Method 1: Checking Authenticity via Properties of the File

Microsoft has included its digital signature in the catalog of almost every executable file. So, the procedure for checking the digital signatures through the properties is pretty straightforward.

1. First, you’ll open the ‘This PC’ window.
2. Then, you’ll type the following address in the address bar of This PC’s opened window and hit the ‘Enter’ key:

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy

3. A new window will open and now you’ll locate the ‘SearchApp.exe’ file.

   

Note: If you’re using an older version of Windows-10 (older than 19H1 update), then look for ‘SearchUI’ instead of ‘SearchApp’

4. Now, you’ll select the ‘SearchApp.exe’ file and press the ‘Alt + Enter’ keys to enter its ‘Properties’ window.
5. Then, you’ll move to the ‘Digital Signatures’ tab and here you’ll find Microsoft’s ownership.

   

6. To get more information, you’ll select the signature and click on the ‘Details’ button.

   

7. A new window will open and now you’ll click on the ‘View Certificate’ button in the ‘General’ tab.

   

8. This will open another new window and here, you’ll find Microsoft’s certification information regarding this executable file.

   

9. You can also hover over to the ‘Certification Path’ tab and view the ‘Certificate status:’ section for verifying the certificate of this executable file.

   

Method 2: Checking via CMD or PowerShell

If you can’t find the ‘Digital Signatures’ Tab in ‘Properties’ of Executable File

For some executable files, Microsoft doesn’t provide the digital signature information inside their catalog. So, if you’re in one such situation, then follow the steps below.

1. First, you’ll follow the ‘first two steps of Method # 1’ for reaching the folder of the executable file (under-discussed).
2. Now, you’ll open any browser and copy-paste the following link:

https://docs.microsoft.com/en-us/sysinternals/downloads/sigcheck

3. Then, you’ll press the ‘Enter’ key to open the required webpage.
4. From the new webpage, you’ll download the ‘Sigcheck’ application by clicking on the ‘Download Sigcheck’ option.

   

5. Once the download is complete, then you’ll extract the downloaded file.
6. After the extraction, you’ll select the file named ‘sigcheck’ and copy it.

   

7. Now, you’ll paste the file inside the ‘SearchApp.exe’ folder and type ‘cmd’ in the address bar of that folder.

   

8. In the CMD window, you’ll type the following command and press the ‘Enter’ key to execute that command:

sigcheck.exe SearchApp.exe

9. A new window will appear and here you’ll find the Digital Signature information of the executable file (under-discussed).

   

Method 3: Checking via Task Manager

Use Only if you don’t know the Path of the Executable File

If you don’t know the path of the running executable file, then you can check the path via Task Manager. So, try the following steps.

1. First, you’ll open the ‘Task Manager’ by pressing the ‘Ctrl + Alt + Delete’ keys or searching in the Start Menu.

   

2. Now, you’ll go to the ‘Processes’ tab and locate the required executable file.

Note: Here, we have randomly picked ‘Speech Runtime Executable.’ But you should go with the required one

3. Then, you’ll right-click on it and choose the ‘Properties’ option.
4. In the ‘General’ tab, you can see the path in front of the entry named ‘Location.’

   

5. Now, you’ll ‘follow Method # 1 or 2’ for completing the rest of the procedure of how to tell if a program is a virus or not.

Method 4: Scanning using Antivirus

Sometimes, companies don’t provide the digital signature information of a file. If you are unable to verify using a digital signature, you can scan the file using an antivirus. For scanning an executable file, you can use any antivirus application. But here, we will use ‘Microsoft Windows Defender’ for checking any executable file for viruses.

Note: We will perform this operation for the ‘AdobeARM.exe’ file. But you can do the same for any executable file

1. Open the ‘Task Manager’ on your system.

   

2. Then, switch to the ‘Details’ tab.
3. Scroll down to find the process or file that you are investigating.
4. Then, select and right-click on the ‘Open file location’ option. Doing this will take you to the root folder of the file.

   

5. Now, right-click on the ‘AdobeARM’ file and choose the ‘Scan with Microsoft Defender…’ option.

   

6. Windows Security (Defender) will scan this executable file and show the results within a few seconds.

   

Conclusion

If you’ve followed all the methods and your signature information is similar to the provided information, then your executable file is safe.

However, your executable file will be dangerous for the system in the following scenarios:

• If you find a suspicious directory in the ‘General’ tab of the executable file’s properties.

OR

• If you find any other ownership in the ‘Details’ tab of the executable file’s properties.

OR

• If the file is using too many GPU and CPU resources. Because often .exe files containing malware are using most of the system’s resources without opening it.

But if you want to know how to check if a file is safe before downloading or how to check if a file has a virus before downloading, then a top browser like Google Chrome, Microsoft Edge, Mozilla Firefox, or Safari can automatically tell that a particular file is safe to download or not.