What is the security benefit of signing an executable that is not a driver? How is the signature verified by the windows?
When an installer is signed but the content doesn't match the signature, Windows will warn you, as a part of UAC, that the publisher is unknown. It still allows you to choose running it and doesn't specify that the problem is with a mismatching signature.
However, compromising a system doesn't require elevation: we are protecting data, not the system! There's also a lot of standalone executables: Windows allows you to run a tampered executable unless it doesn't require admin privileges. It even happily shows the original signatures in the Properties > Digital Signatures; you have to press Details for verification. You also have to do this to figure out why the UAC gave you this warning.
I'll demonstrate this with the well known PuTTY that has been used standalone long before it even had an installer. Let's modify a harmless string from the
putty.exe to avoid breaking it – an attacker would obviously insert malicious code, instead.
Here we see the results, but Windows still runs the executable without any warnings.
You can also see the signatures still in their place. For actual verification, you have to go further to the Digital Signature Details to see that it's not valid.
This is the security benefit of signing even standalone executables. Just like publishing a checksum of the file on your download page, it's an extra measurement for those who would like to be sure.
Frankly, the fraction of the users actually checking this manually is small. People also tend to run the installer anyway: their goal is to install the software and they see the warning merely as an obstacle. However, this doesn't mean that you should avoid signing your executables. We just do our part and keep hoping people would learn – and Microsoft would embrace better security practices by emerging an alert even on standalone executables.