TCPBlock is a free version of little snitch. It's apparently abandoned, but it doesn't need any more features.

http://www.macupdate.com/app/mac/35914/tcpblock

You can set it up to disallow all network traffic until you whitelist the binary. Not sure if it's actually hashing them or just checking the path though.