How do you recognize a fake wallet.dat file?
What should you look for in the HEX editor, or are there other tools?
There is no effective way to tell 100% sure.
If you open the wallet in Bitcoin Core and sync+rescan blockchain with this wallet, then try to change the password and give the proper one - real wallet will change the password correctly, fake wallet will crash Core.
fake wallets different, some of them hav no privkey from adresses with ballances, and, another have no adresses with ballalces in list of adresses awaliable for recive. Old bitcoin-core not crach and work normal for fake and nit fake tests