home

camstudio.exe

CamStudio

The application camstudio.exe has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.vaultsmetadelivery.com and multiple other hosts.
Publisher:
CamStudio

Product:
CamStudio

Version:
2.0.5.a0.1_51213

MD5:
3b4809abf48bbdff5748cd0323f027a8

SHA-1:
4e245b6ff328856b9ea939f9e25150cad3ec30a3

SHA-256:
b5056e834de09716f85874566c68b4a3d83aa2fbc8bd1421b6af4124c2bbd39b

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/1/2024 4:32:29 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.FusionCore.ICDP (L)
16.12.9.16

SUPERAntiSpyware
PUP.InstallCore/Variant
9378

File size:
965 KB (988,198 bytes)

Product version:
2.0.5.a0.1_51213

Copyright:
CamStudio

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\camstudio.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:GJDD+jjh3BLLRVhysOPCvm4YqmAmLAmFs6tkeQ:GRKhj8H4YqmAmhVQ

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file camstudio.exe has been seen being distributed by the following 3 URLs.

http://www.vaultsmetadelivery.com/c?x=oM3bPMStupN0vprmwhSoZ4LvBMzJiiGlNgpvEW0wm3s=&c=jZ72t3I97gZN2gtqzYrXRgeG116EmBABs51 axEE2y4tnHUlHkZYOeKbCcDs8t1WMIIOdvScq65FeBz7lOBWeHmhkfII9xI00rK05Ix4 jUNIqwO/cAt7UKQihq5J6D8f1NDyl3cfgsJt KcVWBy7A==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://www.signtourstower.com/c?x=CJh/jpQMjff0Kh6rHtz7Um3yzJEUlDm3 8hEuB0 uNY=&c=LXQWsZxeA77ZJJtxTciL9CHvheAGONkNhPQTLv1WF0FKLMaGJ/noEbvMprgeR2dudGDp3xaD7ZaAtO7aOknYmWEyJvc1ouiKHl13WG1WfSg8HJ0g x3bwpxnen4h2rI9p1hTLk1KqD1GQ7lDjUXzhg==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://www.contentcapitalvault.com/c?x=E 40uDhj163lB0VqEui2A kJ2wA6MzKKL5zLRDpw9aw=&c=MUHmafwPt8bJOUqH0KL7Q/tntLlXNpoNgH77RCG4Yk0BoP/ymS77e3pQyVkK57WpNBshY1vgi/o2WDnRvHtVvWTMjzqKaW0pG/CfG9YCX3lEeHnwlF7d6fy7ACf/qadif887/JIe5GrmGtd1u7LHWg==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

Remove camstudio.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.