How to look inside a suspicious .exe without uploading it anywhere

Someone sends you a file. Maybe it is a "game crack", maybe a work tool, maybe an attachment you did not expect. You want to know what it is, but you do not want to run it, and you may not want to upload it to an online scanner either. Online scanners keep a copy, and if the file is private (internal software, a client's binary), uploading it can be a problem in itself.

This post shows a quick way to do a first look at a Windows, Linux or macOS program file without running it and without sending it anywhere. I will use binkeep, a free, open source tool I built that runs fully in the browser.

Important: this is static triage, a first look. It does not tell you a file is safe. If something looks wrong, treat the file as dangerous.

Step 0: open the file
Go to https://kano92-dir.github.io/binkeep/ and drag the file onto the page. The file is read by JavaScript and WebAssembly in your own tab. There is no server behind it. If you want to check that, open DevTools, go to the Network tab, and load a file: you will see no upload request. The page also sets a Content Security Policy that blocks outgoing connections.

Step 1: Overview - who made it, and is it signed?
The Overview tab shows the basics: file type, architecture, compile time, and whether the file has an Authenticode signature.

Things to notice:

No signature on something that claims to be from a big company is a red flag.
A compile time in the future or in 1970 usually means the value was faked or stripped.
High entropy (close to 8) across most of the file usually means it is packed or encrypted. The entropy graph shows which parts.
Step 2: Sections - is it packed?
Normal programs have sections like .text, .data, .rdata. Packed files often have odd names (UPX0, .vmp0, random letters), a section that is writable and executable at the same time, or a tiny code section with a huge data blob next to it. binkeep flags known packers it recognizes.

A packed file is not automatically malware, but it means the interesting part is hidden and you will see less in the next steps.

Step 3: Imports - what can it do?
Imports are the Windows functions the program asks for. They are one of the best quick hints:

VirtualAllocEx, WriteProcessMemory, CreateRemoteThread: writing code into another process.
SetWindowsHookEx, GetAsyncKeyState: watching the keyboard.
URLDownloadToFile, InternetOpenUrl, WinHttpSendRequest: downloading or talking to the internet.
RegSetValueEx with a Run key in the strings: starting itself on boot.
IsDebuggerPresent, CheckRemoteDebuggerPresent: trying to detect analysis.
One of these alone means little. Several together, in a file that should not need them, is worth a closer look.

Step 4: Strings - the fastest clue
The Strings tab groups what it finds into categories such as URLs, IP addresses, file paths and registry keys. This is often where a file gives itself away: a hardcoded server address, a Discord webhook, a path in AppData, a ransom note, a PDB path with the author's username.

Step 5: YARA - check against known rules
If you have YARA rules (your own, or public ones), paste them into the YARA tab or load a .yar file. binkeep runs real libyara compiled to WebAssembly, with the pe, elf and math modules, so rules that use pe.imports(...) or math.entropy(...) work. Each match jumps to its offset in the hex view.

Step 6 (optional): Disassembly
If you can read assembly, the Functions and Disasm tabs show the code (x86, x64, ARM, ARM64, using Capstone). You can follow cross references from a suspicious string or import to the code that uses it. This is not a full decompiler. When you need that, move to Ghidra, IDA or Binary Ninja. The point here is to decide in a few minutes whether you need to.

What this cannot do
It cannot run the file, so it will not see what a packed or encrypted file does at runtime.
It does not have a decompiler or a control flow graph.
It does not compare against antivirus databases. If the file is not private, a hash lookup on a service like VirusTotal is still a good extra step. You can do a hash lookup without uploading the file.
Summary
Open it in the browser, nothing leaves your machine.
Check signature, compile time and entropy.
Look at sections for packing.
Read the imports for capabilities.
Scan the strings for URLs, IPs and paths.
Run YARA rules if you have them.
binkeep is MIT licensed and the code is on GitHub: https://github.com/kano92-dir/binkeep. Bug reports and feature requests are welcome. If it helped you, a star helps other people find it.