home

camstudio.exe

CamStudio

Astro Delivery (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application camstudio.exe by Astro Delivery (Fried Cookie) has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from cdn.camstudiodelivery.com and multiple other hosts.
Publisher:
%VENDOR%  (signed by Astro Delivery (Fried Cookie Ltd))

Product:
CamStudio

Version:
2.0.5.a0.1_37346

MD5:
deadd9d44e5a6ea7b8f6a0dbd045ed5e

SHA-1:
1110558dc5a7c8e9fad1bfe0deec6cadfdf63ca1

SHA-256:
b972f40999fca5e6811f7618a89f89c4a94199ae45ef687f6fd9c97909e0815f

Scanner detections:
12 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
1/4/2025 1:40:31 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Bundler
2015.04.14

Avira AntiVirus
PUA/InstallCore.Gen4
3.6.1.96

AVG
Generic
2016.0.3140

Baidu Antivirus
Adware.Win32.InstallCore
4.0.3.15414

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
Application.Win32.InstallCore.DSQ
21753

Dr.Web
Trojan.InstallCore.49
9.0.1.0104

herdProtect (fuzzy)
variant of camstudiosetup_v2.0.5.a0.1_37346_894_stub_astro_delivery__fried_cookie_ltd._.exe (Adware)
2015.7.15.19

Panda Antivirus
PUP/SystemSpeedup
15.04.14.01

Qihoo 360 Security
Win32/Virus.Adware.eef
1.0.0.1015

Reason Heuristics
PUP.Installer.InstallCore
15.4.13.21

VIPRE Antivirus
Trojan.Win32.Generic
39316

File size:
952.4 KB (975,208 bytes)

Product version:
2.0.5.a0.1_37346

Copyright:
%VENDOR%

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\camstudio.exe

Digital Signature
Signed by:
Astro Delivery (Fried Cookie Ltd)

Authority:
COMODO CA Limited

Valid from:
1/6/2015 6:00:00 PM

Valid to:
1/7/2016 5:59:59 PM

Subject:
CN=Astro Delivery (Fried Cookie Ltd), O=Astro Delivery (Fried Cookie Ltd), STREET=28 Lilienblum St., L=Tel Aviv, S=Israel, PostalCode=6513307, C=IL

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00B5DEF5C3088901F4214C78F98CA66045

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:6GwdUyuHsCCQ0QKO36J9sO1nG+tQ3080dwVjd1ygRs7I:6FOyuHsCQA6bsO0+O3eSjdZX

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9061

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file camstudio.exe has been seen being distributed by the following 6 URLs.

http://cdn.camstudiodelivery.com/c?x=OrmskmUDU15ExPvHdhJkDRVp8yWW3 WAlid9eeLVjyE=&c=Q1siKKOuLpHfrV0xzQ u91XgTeshWaFmnjrzQt09yM3gtAhvqE7xCnpYiy1lfoJ8mmW6cZtcSSff29FgyNGDg==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=2fqxiKUEpsgFNLz5IdX3m4rTCpdopAJgtkdeQ09BygM=&c=M XsZhgWcLuUPghBTcu2ux4P8MOnusC/nJWNkZCBI WIxeEAz/ds8CdGNLmbcHmD2dK8zz3ItmQzpG a3o1TXQ==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=1JCk/jPZZ5tmY9XDOzdDw70MTLbBEO3JcVCfjDV0HCs=&c=X6xfFrV1jWc5sYrdSlf 4rdkM3GxZYA0DN/dK9nvRH2UyOXv4b2LLxVP79ZXdwx3RFxLnt4141OQZz5C N4kBw==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=uLgVC1TetD3qqenxh2M8PEecixBGNdutCW06prgmVgU=&c=UCZL9WSkYBXgwO5o2RG1FoEWP62sSPjmrKXusek8PYMqjoUJRgHNNHPnGSkh6QCoTFHqq7KxF9P5PLc30vThcg==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=Li1joz3uaM64vMB1Hwxyr4ekk4 tqwxJUERvYTGVY4Y=&c=AiCv7hGBJDz4NHG9nXh 7jLQn7SgIbi3TJbnnIM7KC2gU1Vqc4GvvGWbbjOGXWmWZQ/TVd4sch9MjLppfYiLoQ==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=Q1NLN YMNRYuysNeGTAwBlKhTNtohzXo14GVTp8ONCg=&c=5LSrpbY9Ihi/gTvWKI5bdMz34o8wurbk43Bi7iuHtpgW6dhxMW IadlKz6bxUuDPYKGQDqCw9D iGV3D3ubhw==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

Remove camstudio.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.