home

camstudio.exe

Path Quality (Alpha Criteria Ltd.)

The application camstudio.exe by Path Quality (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.conceptspresentmeta.com and multiple other hosts.
Publisher:
CamStudio  (signed by Path Quality (Alpha Criteria Ltd.))

Product:
CamStudio

Version:
2.0.5.a0.1_60682

MD5:
8e3004baec010f59c512489e50a1287d

SHA-1:
57968f877552420e111888e8e7ba54155ecde26b

SHA-256:
8109b8899b3ac274efd83612d7535e0238d40ff943d38c93b936354c1b8cfa4b

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/1/2024 8:33:49 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.7.7.14

File size:
990 KB (1,013,792 bytes)

Product version:
2.0.5.a0.1_60682

Copyright:
CamStudio

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\camstudio.exe

Digital Signature
Signed by:
Path Quality (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 6:09:15 AM

Valid to:
8/3/2016 9:53:56 AM

Subject:
CN=Path Quality (Alpha Criteria Ltd.), O=Path Quality (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121865442A968BACB1F4EC1956476A3AE8D

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:A1QPcnADHUAApXfhY/91+Q/C7vMFvaBEi5wsItQ:A6ZepXfDQN17sqQ

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9258

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file camstudio.exe has been seen being distributed by the following 15 URLs.

http://www.conceptspresentmeta.com/c?x= 0TyhTAMUHYWtMbfW/VoDMr1Mi5RGZF4eYV81j2iHo0=&c=v75nNiqAI5ZfeJotLa jZLA8PMYW6LfEuhSEReeSv0Wwc061AK6lBvbZuAqLKD3ky74vJfcc MCEroQu 7 AK5a78qB5TilGzBLGUYrsf2juS/tYbGTMEpAPNali2KgD5LpasPyIQhj4uNaTd2x3vFrxuVrqMzRvn3CfkeS7rs4=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=5rz0528bvdVJrPe92hOCv8B5Wvg8NtLqbmf8rNG2Wwc=&c=oTWk1puDsd4p0to5/EvyS/Tch c QdDVTbe5ceQCMrc1JltHSjfRrD6hYvjkbLgetPw wU8aaERxCNfS4Pi vlQ1vgKIZkF ai5XppwkFGx3V1Kh14AM8QQQXlWb9eiAEN5PL rd5Yiip24W bRPS/fI280MdT82jPypxow2QYM=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=f6vUzucsMPP1GRNtLhAURXHtxWjxxfdhZr2IaLCWUY8=&c=O78RHTJavo/VK49EmHD kfi51ubEfXJkeqoKVXnQAzR4V nUjguFAAPx9xe3q0ZfGLNelBRTyQ0wfh5LR 4H2/uJJ3fTwJWEqeuorfA15YzpQXjgbsdh zWVq3C3zGXVbKUf7QTOLcp8IsZmEUorPLTbvMNtKD3XZj7rgXh2k1c=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=zwuWfCQwwlgveqFEBfd54PZ5tuPf8JtjAiV/wgklCgc=&c=xzsg7SxJuynxDeycrBpbd6Nr4eeHQkJ8FSCvpjSrd5sEi3asvq/wPxZLw9YF3eqlsHZLnIcyPUu9jcm0mO7qlJTQTomzLHLiUleOH agUqL6BAV8sFpe4KJiyFXAGl6MiWtNLHyhXBbRY5MusG3c8/z7Z5e1Sv7rTJPHeqHf 44=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=ezgf5vEs3A7V7YxnLe/xvNTtevpZEWOMOYjHCoE6KgQ=&c=bpBAWsSMhYuTI6PMj5IEv3lpwK8sThvxK81 OCrW31VjiDJOwtiKdB9takI7Y2/FCFQG/bVAJ8VtmYl0KvluBIhhcsagNe4QRT GcRnCfb5mRVjb2VmGNjEK7cDnOqka1b9Sv9dbCrvnmEAigKwxLwp d8Sj3MOLwJjFL2HV0kQ=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=/0BFI Cy4UD2PpsofDaDHlLo2shnP9RjJIX4 9 Dzeo=&e=0&c=IwF5wiAS3QhJzzzUc/MSuuPxSg4H9DMTK4bh982C8PtzMNQh/InAHTH5PkKocOuoyZjaEDEWLhdePLb8lpp6/6z/MpWcCpTyyjRS/OMxSgkqJj gO NLoRIh3aycjKrCa7809QblDLs8hvJBpHqX7yK33DO9Gxw4Xg4CIAM1q7M=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=iIti0FFm5DzG3OnBHmmMaqcqNTp2xWZQBWf4DRY6SuY=&c=/XGQwge5N7v/MyGkXr0uqBShHvl36p/mSSsmdJVtoZdyqdnjkSGmYdOrFUbCq/L HIpkqcL/abwNn1 bXQGqd0kyWljdyYWn7FWukPK7RiE3U 3EsdMzZHDYg6WtpExpnPkPgAvk6hGxvqbScaF5no9zOHNMD5KkDWao/56Rtw=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=FQiRsU26TBrxLHXOZYypB4yx1ncoI0C8AlUZIoGyfZs=&c=dPES2VX9TKGehf7lST33hP2Exew/arWjj4md80wnfVjixg4ZQ0eTg4SWjEtl3FeJnrWWRYudKjWy2Bw8xFcVEoTvGy0modBNZjJ1Utb9UpbWoMAYKN/G3rVvLVQ31menlVeIUy5gdLs08OFWghD9KIUHc48elA2yHqGzzzR2SjM=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=5M8ZfJpLazLxZP1fBulzbmAotIUHvrBdnIgmn8lRrr4=&c=ovu9xsi11Dwz4ulhQI9GIjA MYHnSRWm6VsiwhzN9rS siwKOgJG LBNfeTMeAGddfbrsy/Erm2L7uaau2DmFYwjtecubm fQuHvYDGMrjCHxvyd27QadSlKLimmbIRvhbwby9orzuzFQXtTd/O8fD363Je4/3OzGlJTdZhPwzU=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=AJH2kYs/gqZ01C enUdBQUQeoJO50fWktW iZJukLx4=&c=Ksa4xOkFsV6YCxdussmdWsdNbKyL0N2C3azFp VMNLf24zmyxDGsgsIFvskHuiQIsONPiO4LN4aWifquLTJ78WKjL5FJ1bfWJe SIeFd8Uhwn2EOuLQXJA8JE8HwRJ16COifILbfflLyVKMf495/TBaEl5o0zWzvlcEyUyD003M=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=j5P7V2tCtf4j5W vokM0/RUcYjrwQ8U77JHm37kmVTg=&c=TcZHzyyYE nsfjXzpKHcJ2iqPi327xdmO7NqyqPpkIDR3UHGFkUF1G2IQMZqBi16K0bmwDSGlIx4Arvpu0HZ2SdIXGWeDrs2h RZa8uNcsz6xOkvFTCzH5A3s7y5BpliXYfEtV1HXRABB549bje/EqzTx1/giTn8OpG6n7WXT74=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=r/7mKUgDUUQbDjUqSbUoppWNRuyCIRNUIeA18KcTRGI=&c=ajLSAcmmoWZ7e6Wi7JzCaHdxD/mgq/inZptqa9ynCUpMAwK60YSPI7QtJNeCbJLKhNs3gv9s0KHo NGVOmYSTjXMMJ4gghkMRqjALpKHiBCd3SGDpppWUkrzbUl9Ih6AMlKQLYn7ZbLDNSzltw/L/TfJHzDxITZopVu1xXqYrZA=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=Ds612LOAqHhvSQdL5MVTGXIcbfR cYFYp4Bwy1DNt0=&c= oneyBL2yd5XmI2JnZC7FnvEbAWKJ36A8s5Oy1OBcWdd3kkemP0UaQW SQGPKLV74CQGIe0dgYTf27F sNfkRznHoGqi4yZcrH3fcKtur1H4TVbANsvRA2IpfXgd4ucgq1TNSgkAZby31y2jW7e95f/MI0yAWvO24IljZTiW6A0=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=pqpuEcILSQmo4w 8d5YaIj u/6VpoNU8vH2ZB7utPdQ=&c=BU4zQJagLkDHwdsnxuBG3KGp6ApNFa8eVbgiwzRE Q8GxJ0PKAhPjQ704ctzAB3IskAeaGtdvd3ObsAf5IyaITFhdWcKrEh5Gqd1gLX3Gn t5Rm0J047nTNfcIO2N70U1caOPQ5d71gpBw7wAOpeOwl9DhCrNozASngiIOTLP1k=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=u2VeqoqEb3vQQcY6ujoW5byDHreLfigfiuO Le0lP9w=&c=mYWMcPbBqe8eHvV07W/jMkpeNf59IZZYNcYxBceTokFcVKDp3RPsHhE3BAHP9lTxjCTqsCppCUPXIo3W/ivyMy9Uq3EaU8jKLgRZk R/wh3OiaXN8L2O4tA64y6lDUiYNPaJGyZK1ZtBoPcSKefZ3PWwA41LD3NIZo2qx60XbIw=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

Remove camstudio.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.