A Windows shortcut itself is usually not the best place to look for a software publisher signature. First identify the actual executable or script that the shortcut launches, then inspect that target without running it.
Step 1: recover the real target
- Right-click the shortcut and select Properties.
- Record the complete Target and any command-line arguments.
- If the target is obscured or the properties are incomplete, use the local LNK File Safety Checker. It parses the file in your browser and does not upload it.
- Do not click Open File Location if doing so would also launch or invoke an unfamiliar command. Navigate to the path separately in File Explorer.
Step 2: inspect the executable signature
For an executable or installer, open its file Properties and look for the Digital Signatures tab. Select the signature, view details, and confirm the reported status and signer. A trusted signature should match the publisher you expected.
Administrators can also use a read-only PowerShell check:
Get-AuthenticodeSignature -LiteralPath 'C:\Path\To\Target.exe' | Format-List Status,StatusMessage,SignerCertificate,TimeStamperCertificateReplace the example with the exact local path. This reads signature information; it does not launch the executable.
What to verify
| Check | Question to answer |
|---|---|
| Signature status | Does Windows report the signature as valid, invalid, unknown, or absent? |
| Publisher identity | Does the signer name match the vendor and product you intended to install? |
| File location | Is the binary stored in the expected installed-program folder rather than a temporary or hidden location? |
| Hash | Does the SHA-256 value match a value published through a trusted vendor channel? |
| Command arguments | Does the shortcut add an unexpected script, remote address, encoded command, or elevation request? |
What a signature can and cannot prove
A valid signature helps establish publisher identity and whether the signed bytes changed after signing. It does not guarantee that the publisher is trustworthy, that the software is free of vulnerabilities, or that every command-line argument is safe. Conversely, an unsigned file is not automatically malicious; many small utilities are distributed unsigned.
If the shortcut launches a script
Authenticode checks can apply to some signed PowerShell scripts, but many script formats are unsigned. Do not execute the script to inspect it. Record its path, scan it, and have a qualified analyst review its text and surrounding files in a controlled environment.
Frequently asked questions
Can malware have a valid digital signature?
Yes. A signature is one trust signal, not a complete security verdict. Publisher identity, reputation, behavior, source, and current endpoint detections still matter.
Why is there no Digital Signatures tab?
The file may be unsigned or use a format that Windows does not expose through that tab. Confirm that you are inspecting the actual target, not only the shortcut.
Does changing the shortcut change the executable signature?
No. The Shell Link and its target are separate files. Changing shortcut arguments can alter behavior without changing the target executable’s signed bytes.