Description
You downloaded an exe. Is it signed, by whom, and has the certificate expired? The Properties dialog shows half the answer and certainly will not scan a whole folder. Sigcheck is a Sysinternals command-line tool that prints the version, timestamp, digital signature and the full certificate chain in one command, and with -h it computes MD5, SHA-1 and SHA-256 on the side.
It is even handier when you are hunting for something suspicious: -u lists only unsigned files, -s recurses through a directory, -e focuses on executable images, and it can look hashes up on VirusTotal without uploading the file first.
Signature check: shows signing status, publisher, validity period and the whole certificate chain, so a bad or revoked signature stands out
File details: prints product name, version, build time, publisher and even the embedded manifest without opening property windows one by one
Bulk scan: recurse into a folder and keep only unsigned files with -u, so strays hiding in system directories show up fast
Hashes and reputation: several hashes at once with optional VirusTotal lookups, and results can be exported to CSV for records
It is even handier when you are hunting for something suspicious: -u lists only unsigned files, -s recurses through a directory, -e focuses on executable images, and it can look hashes up on VirusTotal without uploading the file first.
Features
Signature check: shows signing status, publisher, validity period and the whole certificate chain, so a bad or revoked signature stands out
File details: prints product name, version, build time, publisher and even the embedded manifest without opening property windows one by one
Bulk scan: recurse into a folder and keep only unsigned files with -u, so strays hiding in system directories show up fast
Hashes and reputation: several hashes at once with optional VirusTotal lookups, and results can be exported to CSV for records
