A convincing download page is not proof of a genuine installer
Start from the vendor’s official route, inspect the exact file and distinguish a checksum match from publisher trust.
In brief
Microsoft’s September 2026 report tracks counterfeit vendor download pages delivering malicious installers. Search visibility, branding and a plausible setup filename can all be part of the deception.
The safer workflow identifies the distribution source before downloading, then verifies what the vendor actually provides for that file.
Find the distribution identity
Confirm the hostname and official navigation path. Avoid a download mirror chosen solely for a prominent button. A familiar logo and copied support text can be reproduced on another domain. Check the intended platform and version at the source.
Verify what can be verified
Use the vendor’s actual published verification method. LA24X’s local hash tool can calculate a file digest without uploading it, but it cannot declare the publisher trustworthy. Compare only with a reference obtained through an appropriate independent trusted route.
Inspect a Windows file without running the installer
In PowerShell, replace the example path with your downloaded file and run the following read-only commands. They inspect the file rather than launching it. Read the Status and SignerCertificate fields; compare the signer with the publisher you expected. An unsigned file is not automatically malicious, and a valid signature is not a guarantee of harmless behaviour.
Compare the SHA-256 digest only when the vendor publishes a digest for that exact release. A match proves equality with the reference you chose, so the reference source still matters. The local hash tool linked below is an alternative if you prefer not to use PowerShell.
Get-AuthenticodeSignature -LiteralPath 'C:\Downloads\installer.exe' | Format-List Status,SignerCertificate
Get-FileHash -LiteralPath 'C:\Downloads\installer.exe' -Algorithm SHA256Documentation for these steps: Microsoft Learn — Get-AuthenticodeSignature ↗ · Microsoft Learn — Get-FileHash ↗
If you already ran it
Treat execution differently from merely downloading a file. Use trusted security support and protect potentially affected accounts from a clean device. Keep the source and timing as evidence; removing the installer file does not undo software or persistence it created.
Keep the source check separate from the digest calculation; neither tool declares a download safe. Check a download’s SHA-256 hash on Windows · Review a software dependency’s supply chain before trusting it
Before you act
A checksum copied from the same untrusted page does not independently establish authenticity. A file extension or a polished installer UI is not a security verdict.
What to do next
- Open the known official vendor site or supported app-store route independently.
- Check product, platform and any genuine signature or checksum guidance.
- If the source is unclear, stop before execution; investigate a run installer as a device exposure rather than deleting only the download.
