The Undertale Setup exe (Undertale Setup) Toby Fox File Malware Analysis

The Undertale_Setup.exe (Undertale Setup) File Analysis

Updated 1 month ago

Checked by Malware Check

Undertale_Setup.exe

Hash Type	Value	Action
MD5	0f4fe3b04d6835439ffe38136a20ad32
SHA1	30345885b15f03f87040917bceee9f14b0870c68
SHA256	df0c50879441d652f8c1ff901eb102e88ffb2f54c4073f662f722a38edabedd4
SHA512	a405079e870c481312b5f13861a07db2ea4d3ff743543eace04fa6113c0daff2f95fadb4bf6ec982b1a74946e6e19f2e53fdf1a0be9ef5e535c6c6aa7f96dc50
ImpHash	e8ac1646024d52d1534a88da2e8037cd

Hash Type

Value

Action

MD5

0f4fe3b04d6835439ffe38136a20ad32

SHA1

30345885b15f03f87040917bceee9f14b0870c68

SHA256

df0c50879441d652f8c1ff901eb102e88ffb2f54c4073f662f722a38edabedd4

SHA512

a405079e870c481312b5f13861a07db2ea4d3ff743543eace04fa6113c0daff2f95fadb4bf6ec982b1a74946e6e19f2e53fdf1a0be9ef5e535c6c6aa7f96dc50

ImpHash

e8ac1646024d52d1534a88da2e8037cd

PE Analysis

Basic Information

▼

Icon	Hash: 821597ea6973b51a27583e2542eb3954 Fuzzy: 3b5d3c7d207e37dceeedd301e35e2e58 dHash: 0000000000000000
Image Base	`0x00400000`
Entry Point	`0x004b0028`
Compilation Time	2025-09-23 05:03:52
Checksum	0x00000000 (Actual: 0x002fbe26)
OS Version	6.1
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	5 libraries kernel32, comctl32, user32, oleaut32, advapi32
Exports	2 functions
Resources	27 Resources
Sections	11 Sections

Version Information

▼

Comments	This installation was built with Inno Setup.
CompanyName	Toby Fox
FileDescription	Undertale Setup
FileVersion
LegalCopyright
OriginalFileName
ProductName	Undertale
ProductVersion	1.08
Translation	0x0000 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	709,648 bytes	710,144 bytes	6.40 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`57C1046B0C4E991CECBEF13470E09BC3`
`.itext`	`0x000af000`	6,564 bytes	6,656 bytes	6.15 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2C31CA36E4D24C61D385480BF9CB14EB`
`.data`	`0x000b1000`	16,264 bytes	16,384 bytes	5.19 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`91CEE01909C3FC8FD4BAC66278085C17`
`.bss`	`0x000b5000`	29,428 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000bd000`	4,160 bytes	4,608 bytes	4.80 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`F849032F54ACCD8F4903145AA33467DE`
`.didata`	`0x000bf000`	420 bytes	512 bytes	2.75 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`3EC33874564110438442546FD72444E3`
`.edata`	`0x000c0000`	113 bytes	512 bytes	1.25 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D77A43A3A9DD3DA66B78213D8C02F390`
`.tls`	`0x000c1000`	24 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000c2000`	93 bytes	512 bytes	1.38 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9468008ADFF885F9E01B8D0193650506`
`.reloc`	`0x000c3000`	70,744 bytes	71,168 bytes	6.71 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`F7143460C83F887444022B3703D77650`
`.rsrc`	`0x000d5000`	196,420 bytes	196,608 bytes	2.47 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`FFA1AED5C1D5B736BD6540E16C04065E`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 27 (194,907 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	9	181,611 bytes	93.2%
RT_STRING	12	8,788 bytes	4.5%
RT_RCDATA	3	1,004 bytes	0.5%
RT_GROUP_ICON	1	132 bytes	0.1%
RT_VERSION	1	1,412 bytes	0.7%
RT_MANIFEST	1	1,960 bytes	1%

Certificate Chain Analysis

▼

Certificate Information

Product	Undertale
Description	Undertale Setup

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	Undertale_Setup.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.230.174
Database Version	2025-12-06 01:00:16 UTC

The Undertale_Setup.exe (Undertale Setup) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification