yesterday I needed to update my realtek sound driver, so I went over to the official realtek download site, which by the way did not have a secure connection, and from there I downloaded a 200MB, unsigned exe file that purported to be the driver I needed.
In fact it was. But how could I have checked it out before running the file?
The generally accepted method for large file validation is file hash comparison - but that only works if the file hash is provided at the point of download. And all that tells you is that the downloaded file has not been modified in-transit; it doesn't tell you if the file is safe or malicious.
RealTek doesn't provide the file hash if I remember correctly.
You can set some AV scanners to scan large files by manually increasing the maximum file size to be scanned. Doing so is unlikely to yield any meaningful result since large size malicious files are rarely submitted and thereby signatures created for them. You might get lucky and get an accurate heuristics detection - but it isn't likely. You're probably more likely to get a false positive.
Large size file validation has always been a problem, but then again, large size malware is quite rare.
You can always decompile the file and manually inspect each line of code.
