File scan report
Verdict Safe
Is Undertale Yellow.
None of the 70 antivirus engines that checked it flagged this unsigned executable, and the completed sandbox run found no confirmed injection target, persistence, or malicious…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 70 antivirus engines that checked it reported a detection, including all 17 major contributors, and the completed sandbox run returned clean.
The strongest evidence is the complete absence of detections among 75 engines, with all 17 major contributors silent. One completed sandbox run returned clean and did not record a target in the injected-process list. Although the runtime mapping includes T1005, T1055, and T1548, technique mappings can be noisy and no concrete injection target, persistence mechanism, or malicious child was identified. The executable is also not packed, and neither malware-specific research rules nor the malware sample index produced a match. Its unsigned status and the missing complete host-reputation check reduce confidence, but they do not independently establish hostile activity.
What We Detected
None of the 70 antivirus engines that checked it flagged the executable, including all 17 major contributors. No engine supplied a malware family, and independent research checks produced no malware-specific rule or sample-index match.
Threat Behavior
One completed sandbox run returned clean. It mapped activity to T1005, T1055, and T1548, but did not identify a process-injection target, persistence indicator, dropped file, or malicious child. The only recorded IP contact was identified as analysis-environment background traffic, not sample activity. No complete host-reputation cross-check was saved, so network reputation remains unverified rather than clean.
What To Do Now
Obtain the executable from the project's official distribution channel and verify its SHA-256 before running it. Because it is unsigned, retain security software and consider first execution in an isolated environment if the download source is uncertain.
Where this verdict could be wrong4 caveats
- The executable is unsigned, so publisher identity and provenance cannot be authenticated.
- The sandbox mapped T1005, T1055, and T1548, although it did not identify an injection target, persistence, or a malicious runtime verdict.
- No complete reputation check was saved for observed hosts, limiting conclusions about network reputation.
- A community annotation applied several malware-related tags, but these are uncorroborated by engine detections, malware-specific research rules, or the completed sandbox run.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it reported a detection, including all 17 major contributors.
- The completed sandbox run returned clean and recorded no injected target or persistence indicator.
- No packed or high-entropy code was identified.
- No malware-specific research rule, known malware-sample match, or malicious file it created was found.
- The file has been submitted by 204 sources across 222 submissions, providing broader exposure than a one-off sample.
- The Windows executable has no digital signature, so its publisher cannot be authenticated.
- The sandbox mapped possible process injection, data collection, and privilege-related activity, though it did not identify a concrete target or malicious outcome.
- A complete reputation check for observed hosts was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 3spawned processes
- 0network contacts
- 13filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
14MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1005
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1056· Keylogging
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1497· Sandbox evasion
- T1548
- T1574· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
Undertale Yellow.exe"C:\Users\<USER>\Desktop\Undertale Yellow.exe"Undertale Yellow.exe"C:\Users\user\Desktop\Undertale Yellow.exe"OpenWith.exeC:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Files
3Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Microsoft\Windows\Caches - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer - Written
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType - Set
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\10 - Set
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\55
Show all 15 entries for registry and auto-start
- Set
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\55\Shell - Set
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\56 - Set
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\56\ComDlg - Set
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\56\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} - Set
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\10\NodeSlot - Set
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\10\MRUListEx - Set
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\55\Shell\SniffedFolderType - Set
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot - Set
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\56\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\Shell.CMruPidlListLocal\SessionImmersiveColorMutexGlobal\SyncRootManagerLocal\Mutexf01b4d95cf55d32a.automaticDestinations-msGlobal\OneSettingQueryMutex+compat+encapsulationGlobal\C::Users:azure:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwWriterMutex
Show all 10 entries for mutexes
Global\C::Users:azure:AppData:Local:Microsoft:Windows:Explorer:thumbcache_32.db!dfMaintainerGlobal\C::Users:azure:AppData:Local:Microsoft:Windows:Explorer:thumbcache_96.db!dfMaintainerGlobal\C::Users:azure:AppData:Local:Microsoft:Windows:Explorer:thumbcache_256.db!dfMaintainerGlobal\C::Users:azure:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1024.db!dfMaintainer
Sandbox background — not the file
9The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
Show all 9 entries for sandbox background — not the file
- VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p - VM host
162.159.36.2
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 12, 2026, 9:46 PM UTC
- SHA-256
5c59ac5466e892d0c25388770f6807a343f8183c6f63f38e2b6beff936aab78b- SHA-1
17a4d493e2e27434fbb2bf5f3b8b72f2a76c3cf5- MD5
ab10b798104e294f36aca7cad0f77c6d
About this file
Undertale Yellow.exe is a Win32 EXE file of 8.8 MB.
- Type and size
- Win32 EXE · 8.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jul 30, 2026On VirusTotal.
- Submitted by
- 204 distinct sources
- Packer
- None detected
- Entropy
- 6.11 of 8
First scanned
Antivirus consensus
0 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITNo result
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Undertale Yellow.exe safe?
What is Undertale Yellow.exe?
How many antivirus engines detected Undertale Yellow.exe?
What is the SHA-256 hash of Undertale Yellow.exe?
Is it safe to run Undertale Yellow.exe?
How up to date is this analysis of Undertale Yellow.exe?
Community
Member reviews and reports for this exact file hash.