The YellowStar2025 exe File Malware Analysis

Technical Analysis

File Name	YellowStar2025.exe
File Type	PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version	1.0.229.174
Database Version	2025-12-01 17:00:34 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	f775bcfd156c2a0d32cfab8c527f2f71
SHA1	4eaf291eeea8a20cba9d5eb31c82788cf68a2090
SHA256	b1d7197b4620859dee0581a547d76775558587169613140584a0695381ffaca9
SHA512	6e01c1d20d4fe4f76a505b46733a4ef902ebd544418bc19f1ec3479b93c339b114e0ad83d860b86cb88fdf101f7c1ebf099ff49caad80221bcc383d2ba1c28b1
ImpHash	5c5322124baf54459bcf690a53909695

PE Analysis

Basic Information

▼

Icon	Hash: c39c35b20d3bfbf392fd6884618a9fe6 Fuzzy: 8f6c8bcb0505891cfc77a9e235a18259 dHash: b2d4f0ccf8e9ccd4
Image Base	`0x140000000`
Entry Point	`0x14127c515`
Compilation Time	2025-11-22 12:41:14
Checksum	0x00000000 (Actual: 0x00d06c03)
OS Version	6.0
PEiD Signatures	`PE32+ executable (GUI) x86-64, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	2 libraries WS2_32, KERNEL32
Exports	0 functions
Resources	11 Resources
Sections	11 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	465,336 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00073000`	169,008 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.data`	`0x0009d000`	19,160 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.pdata`	`0x000a2000`	31,068 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.gfids`	`0x000aa000`	1,680 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.tls`	`0x000ab000`	9 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.UPX0`	`0x000ac000`	8,225,138 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.UPX1`	`0x00885000`	2,680 bytes	3,072 bytes	0.12 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`CE0F3F3475E5F48C753498953DF7F522`
`.UPX2`	`0x00886000`	13,443,796 bytes	13,444,096 bytes	7.95 (Packed/Encrypted)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`DFF61F0A01631EDE936D98C60EDB20BB`
`.reloc`	`0x01559000`	248 bytes	512 bytes	2.33 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`640F1F939EE561018042057EF6D1A634`
`.rsrc`	`0x0155a000`	180,556 bytes	180,736 bytes	4.13 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3F34A37746D78DCC0CDAFD1B8C7EE332`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼

Total Resources: 11 (179,933 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	9	179,253 bytes	99.6%
RT_GROUP_ICON	1	132 bytes	0.1%
RT_MANIFEST	1	548 bytes	0.3%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The YellowStar2025.exe File Analysis