home

spassist.exe

SoftPlanet Software Assistant

Secure Download

The application spassist.exe by Secure Download has been detected as adware by 2 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This file is typically installed with the program SoftPlanet Software Assistant version 1.19 by Secure Download Ltd. which is a potentially unwanted software program.
Publisher:
Secure Download Ltd.  (signed by Secure Download)

Product:
SoftPlanet Software Assistant

Version:
1.19.0.0

MD5:
a2dfb07abb7086f5f27dcd4eebd53490

SHA-1:
587f337013c3887c4d72ac1f693fb2289e2588df

SHA-256:
cbe2e719caffcc56d0ad31b645568e53370b855fa46b4e064df2906d0c774592

Scanner detections:
2 / 68

Status:
Adware

Analysis date:
8/5/2025 2:54:57 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Downware.11222
9.0.1.0187

Reason Heuristics
PUP.AVSoftware EOOD.SecureDownload (M)
15.7.6.22

File size:
4.3 MB (4,510,728 bytes)

Product version:
1.0.0.0

Copyright:
© 2013-2014 Secure Download Ltd.

Original file name:
spassist.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\softplanet software assistant\spassist.exe

Digital Signature
Signed by:
Secure Download

Authority:
Symantec Corporation

Valid from:
2/2/2015 4:00:00 PM

Valid to:
5/4/2017 4:59:59 PM

Subject:
CN=Secure Download, O=Secure Download, L=Varna, S=Varna, C=BG

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3D811659B9EF01A0EA3D317945C68F04

File PE Metadata
Compilation timestamp:
12/9/2013 8:05:16 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:thaUYo1bQ+tCJv9dnRQg1RgSUvKrSUsmZKmU33LkPw1klHomMHH8Lph6n6IQTGTv:thatoJkLNKmU33LiKm08LLIsq

Entry address:
0x3BC590

Entry point:
55, 8B, EC, 83, C4, F0, 53, B8, 54, E7, 7A, 00, E8, 4F, 23, C5, FF, E8, 9A, A5, C4, FF, 85, C0, 7E, 07, E8, E5, 20, FF, FF, EB, 2F, 68, E8, C5, 7B, 00, 6A, FF, 6A, 00, E8, A5, 5C, C5, FF, 8B, D8, 85, DB, 74, 1B, E8, D2, 5D, C5, FF, 3D, B7, 00, 00, 00, 74, 0F, E8, BE, 20, FF, FF, 85, DB, 74, 06, 53, E8, 2C, 5C, C5, FF, 5B, E8, AE, CD, C4, FF, 00, 00, 7B, 00, 37, 00, 46, 00, 37, 00, 45, 00, 43, 00, 44, 00, 39, 00, 35, 00, 2D, 00, 43, 00, 43, 00, 36, 00, 34, 00, 2D, 00, 34, 00, 32, 00, 38, 00, 30, 00, 2D, 00...
 
[+]

Entropy:
6.6355

Developed / compiled with:
Microsoft Visual C++

Code size:
3.7 MB (3,913,728 bytes)

Scheduled Task
Task name:
SoftPlanet Software Assistant

Trigger:
Logon (Runs on logon)


The file spassist.exe has been discovered within the following program.

SoftPlanet Software Assistant version 1.19  by Secure Download Ltd.
Distrubuted by AVSoftware, the software wraps legitimate and open source programs in a download manager type bundle that includes various offers for toolbars and web browser plugins, mostly ad-supported software.
www.softplanet.com
80% remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-54-69-50-113.us-west-2.compute.amazonaws.com  (54.69.50.113:80)

TCP (HTTP):
Connects to ec2-54-191-101-105.us-west-2.compute.amazonaws.com  (54.191.101.105:80)

TCP (HTTP):
Connects to static.vnpt.vn  (113.171.237.118:80)

TCP (HTTP):
Connects to server-54-239-132-51.sfo9.r.cloudfront.net  (54.239.132.51:80)

Remove spassist.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.