A forensics analyst suspects that a breach has occurred. Security logs show the company's OS patch system may be compromised, and it is serving patches that contain a zero-day exploit and backdoor…

File size is trivially manipulated by an attacker and provides no cryptographic assurance about the authenticity or integrity of the executable.

Legitimate software patches are cryptographically signed with the vendor's private key, and any modification to the binary after signing invalidates the signature when verified against the vendor's public key. Because the attacker cannot reproduce a valid vendor signature without possessing the private key, a failed digital signature check on the extracted executable confirms tampering and the presence of unauthorized code such as a backdoor.

Checksums verify data integrity but are only reliable when sourced from a trusted, uncompromised location - since the patch server itself is suspected to be compromised, the published checksums may also have been replaced to match the malicious file.

Anti-malware software relies on known signatures and heuristics and by definition cannot reliably detect a zero-day exploit with no prior signature in its database.

Sandboxing analyzes runtime behavior of the executable but does not confirm whether the file was authentically signed by the vendor or whether it has been tampered with at the binary level.