There are various signatures tha you can use to ensure the integrity of your MultiBit downloads.

The 0.5.18 release notes have SHA256 hashes of the binaries: https://multibit.org/releases/multibit-0.5.18/release.txt

You can check the SHA256 hash of the file you have and it should match. If it does NOT match then DO NOT USE it.

Try downloading it again from https://multibit.org. It could be that it the download failed.

Signed Windows binaries have a "main" signature, and they can optionally have one or more "countersignatures", typically from timestamping services.

I downloaded the MultiBit Windows installer* from https://multibit.org/ and verified its GPG signature. The file I downloaded has a valid main signature, but it has an invalid countersignature because the timestamping countersigner's (COMODO's) certificate appears to have expired on May 10.

If the signature error message you're getting (right click the file, click Properties, click the Digital Signatures tab, click "sha1", click Details) is "One of the countersignatures is not valid", then it's probably safe to install.

However I'd still strongly recommend you follow jim618's advice and verify the file via another means before running it.

_{*My download had an SHA-256 of: dc0c2ef689507c57347c0cbed58ea90fe12617a6fb026b308e81ec2127531b7e}