home

SFAgent.exe

SPAMfighter

SPAMfighter ApS

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘sfagent’.
Publisher:
SPAMfighter ApS  (signed and verified)

Product:
SPAMfighter

Description:
SPAMfighter Agent

Version:
7.5.131.0

MD5:
0cae7a1aeb4806772e41abf568210e20

SHA-1:
034c9fcc7ce819bd34e04e3240872d0dcf17f6b3

SHA-256:
1679f5b61b47d5b38f507f1417a1406ede7453d2cf2497470fb20be310f52291

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/24/2024 8:57:16 AM UTC  (today)

File size:
1.1 MB (1,197,704 bytes)

Product version:
7.5.131.0

Copyright:
Copyright (C) 2003, 2009 SPAMfighter ApS

Original file name:
SFAgent.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\fighters\spamfighter\sfagent.exe

Digital Signature
Signed by:
SPAMfighter ApS

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
2/21/2010 7:00:00 PM

Valid to:
4/24/2012 7:59:59 PM

Subject:
CN=SPAMfighter ApS, OU=Application Development, O=SPAMfighter ApS, L=Copenhagen, S=Denmark, C=DK

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
32B433AEF06DE4646ADEAF1EB3852EF0

File PE Metadata
Compilation timestamp:
3/15/2012 6:23:50 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:SzokmP4j3uuCkToSC+VKkN4R2qe2S69vqII/P:SlzuuRTFBOreg9vqII/P

Entry address:
0x7D086

Entry point:
E8, F9, D4, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 18, 53, 8B, 5D, 0C, 56, 8B, 73, 08, 33, 35, D4, 80, 50, 00, 57, 8B, 06, C6, 45, FF, 00, C7, 45, F4, 01, 00, 00, 00, 8D, 7B, 10, 83, F8, FE, 74, 0D, 8B, 4E, 04, 03, CF, 33, 0C, 38, E8, D2, DD, FF, FF, 8B, 4E, 0C, 8B, 46, 08, 03, CF, 33, 0C, 38, E8, C2, DD, FF, FF, 8B, 45, 08, F6, 40, 04, 66, 0F, 85, 16, 01, 00, 00, 8B, 4D, 10, 8D, 55, E8, 89, 53, FC, 8B, 5B, 0C, 89, 45, E8, 89, 4D, EC, 83, FB, FE, 74, 5F, 8D, 49, 00, 8D, 04, 5B, 8B, 4C, 86...
 
[+]

Entropy:
6.5560

Code size:
749 KB (766,976 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
sfagent

Command:
C:\Program Files\fighters\spamfighter\sfagent.exe


Scan SFAgent.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.