home

sfa_inst.exe

Smart File Advisor

Total PC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application sfa_inst.exe, “Smart File Advisor Setup ” by Total PC has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer.
Publisher:
Filefacts.net   (signed by Total PC)

Product:
Smart File Advisor

Description:
Smart File Advisor Setup

Version:
1.1.8.0

MD5:
ecb2814a50b146f16d5d2892da7c9a30

SHA-1:
5e12d919e3e8d86abaccd1be7fcac00927fb013c

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/25/2024 4:04:57 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
17.2.11.20

File size:
1.8 MB (1,935,830 bytes)

Product version:
1.1.8

Copyright:
Copyright © 2010-2015 Filefacts.net

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore

Common path:
C:\Program Files\smart file advisor\sfa_inst.exe

Digital Signature
Signed by:
Total PC

Authority:
COMODO CA Limited

Valid from:
3/17/2015 1:00:00 AM

Valid to:
3/17/2016 12:59:59 AM

Subject:
CN=Total PC, O=Total PC, STREET=Unit A6 Dundonald Enterprise Park, STREET=Carrowreagh Road, STREET=Dundonald, L=Belfast, S=Antrim, PostalCode=BT161QT, C=GB

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00B2DF3698915A5B9CA523FD5D2457DB45

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

Entry address:
0x14000

Entry point:
90, 90, B8, 3C, 47, 8D, 00, 68, 1C, 40, 41, 00, 5F, 90, 90, 68, 98, 05, 00, 00, 5E, 90, 90, 31, 04, 3E, 83, EE, 03, 4E, 75, F7, D4, 3A, 8C, 00, 3C, 47, 8D, 00, 3C, 47, CD, 00, 7C, DB, 8D, 00, DC, 95, 97, 00, EA, 9E, 97, 00, 3C, F7, 8F, 00, C3, B8, 72, FF, 88, 97, CD, 00, 58, 95, CD, 00, 40, 95, CD, 00, 3C, 47, 8D, 00, 3C, 47, 8D, 00, 3C, 47, 8D, 00, 88, DB, 8D, 00, 5E, 95, 8D, 00, 46, 95, 8D, 00, 3C, 47, 8D, 00, 3C, 47, 8D, 00, 3C, 47, 8D, 00, 3C, 47, 8D, 00, 20, 96, CD, 00, 3C, 47, 8D, 00, 3C, 47, 8D, 00...
 
[+]

Code size:
37 KB (37,888 bytes)

Remove sfa_inst.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.