File scan report
Verdict Safe
Is Undertale Yellow.
None of the 70 antivirus engines that checked it flagged this unsigned executable, and the completed sandbox run found no confirmed injection target, persistence, or malicious…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 70 antivirus engines that checked it reported a detection, including all 17 major contributors, and the completed sandbox run returned clean.
The strongest evidence is the complete absence of detections among 75 engines, with all 17 major contributors silent. One completed sandbox run returned clean and did not record a target in the injected-process list. Although the runtime mapping includes T1005, T1055, and T1548, technique mappings can be noisy and no concrete injection target, persistence mechanism, or malicious child was identified. The executable is also not packed, and neither malware-specific research rules nor the malware sample index produced a match. Its unsigned status and the missing complete host-reputation check reduce confidence, but they do not independently establish hostile activity.
What We Detected
None of the 70 antivirus engines that checked it flagged the executable, including all 17 major contributors. No engine supplied a malware family, and independent research checks produced no malware-specific rule or sample-index match.
Threat Behavior
One completed sandbox run returned clean. It mapped activity to T1005, T1055, and T1548, but did not identify a process-injection target, persistence indicator, dropped file, or malicious child. The only recorded IP contact was identified as analysis-environment background traffic, not sample activity. No complete host-reputation cross-check was saved, so network reputation remains unverified rather than clean.
What To Do Now
Obtain the executable from the project's official distribution channel and verify its SHA-256 before running it. Because it is unsigned, retain security software and consider first execution in an isolated environment if the download source is uncertain.
Where this verdict could be wrong4 caveats
- The executable is unsigned, so publisher identity and provenance cannot be authenticated.
- The sandbox mapped T1005, T1055, and T1548, although it did not identify an injection target, persistence, or a malicious runtime verdict.
- No complete reputation check was saved for observed hosts, limiting conclusions about network reputation.
- A community annotation applied several malware-related tags, but these are uncorroborated by engine detections, malware-specific research rules, or the completed sandbox run.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it reported a detection, including all 17 major contributors.
- The completed sandbox run returned clean and recorded no injected target or persistence indicator.
- No packed or high-entropy code was identified.
- No malware-specific research rule, known malware-sample match, or malicious file it created was found.
- The file has been submitted by 204 sources across 222 submissions, providing broader exposure than a one-off sample.
- The Windows executable has no digital signature, so its publisher cannot be authenticated.
- The sandbox mapped possible process injection, data collection, and privilege-related activity, though it did not identify a concrete target or malicious outcome.
- A complete reputation check for observed hosts was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 3spawned processes
- 0network contacts
- 13filesystem & mutex artifacts
Includes the sandbox verdicts, 14 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 12, 2026, 9:46 PM UTC
- SHA-256
5c59ac5466e892d0c25388770f6807a343f8183c6f63f38e2b6beff936aab78b- SHA-1
17a4d493e2e27434fbb2bf5f3b8b72f2a76c3cf5- MD5
ab10b798104e294f36aca7cad0f77c6d
About this file
Undertale Yellow.exe is a Win32 EXE file of 8.8 MB.
- Type and size
- Win32 EXE · 8.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jul 30, 2026On VirusTotal.
- Submitted by
- 204 distinct sources
- Packer
- None detected
- Entropy
- 6.11 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Undertale Yellow.exe safe?
What is Undertale Yellow.exe?
How many antivirus engines detected Undertale Yellow.exe?
What is the SHA-256 hash of Undertale Yellow.exe?
Is it safe to run Undertale Yellow.exe?
How up to date is this analysis of Undertale Yellow.exe?
Community
Member reviews and reports for this exact file hash.