home

camstudio.exe

Path Quality (Alpha Criteria Ltd.)

The application camstudio.exe by Path Quality (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.conceptspresentmeta.com and multiple other hosts.
Publisher:
CamStudio  (signed by Path Quality (Alpha Criteria Ltd.))

Product:
CamStudio

Version:
2.0.5.a0.1_60682

MD5:
9567b602f947b8beb9e28a35d8ae9d46

SHA-1:
67747ac3b20cdc26b72ede6b145994e2114bb404

SHA-256:
44854faa2fb4dec61c9d8e38bf275e5644a06042bead33b7350610c34ed403d9

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 8:38:02 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.7.7.13

File size:
990 KB (1,013,792 bytes)

Product version:
2.0.5.a0.1_60682

Copyright:
CamStudio

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\camstudio.exe

Digital Signature
Signed by:
Path Quality (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 12:09:15 PM

Valid to:
8/3/2016 2:53:56 PM

Subject:
CN=Path Quality (Alpha Criteria Ltd.), O=Path Quality (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121865442A968BACB1F4EC1956476A3AE8D

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:r1QPcnADHUAApXfhY/91+Q/C7vMFvaBEi5wsItQ:r6ZepXfDQN17sqQ

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9258

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file camstudio.exe has been seen being distributed by the following 17 URLs.

http://www.conceptspresentmeta.com/c?x=AAarNLOU7unSmVEkpee3V5ho2lCx99vinDwINeJs/78=&c=l kn/469ChA/AE 4lNKePgcwnOjLng3dhWP2f6YQ7jfS37PUmG/vHVhH/Gpa4IhmIXhH1DcloaU qKwephlD64s3zpCDCr5E6DYZfnRzPscnIh9BR1E0okT67HDq05oOFk8qJpz6h2ZFovGLAS6Y8HJ2Honkab 7NG14L3F2xWw=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=0/ax5w3g/m14FLt9dpJ891iJdU0MJ2zCOedPSNM2OQs=&c=u7V4qLttM8V//zHPjj03g8F0bDomfTSGzyIWKuZX3JKSfMU4jW2n 6heZouUaKb3qIxBcha8S4F7hLqqHHTeGfrc19 lJymLLJdJcPHON/NDIENPw1iTSJolixOYpHV/nIGpOZ/B93JvfHxDGsCywVpGnKD/t92Y00qoNsypyoI=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=BIq7ZzWH90V2TaUit43LCGyvMhqiQAbLHqu8N5fAI8s=&c=//75lZic47xirn2x m5YbcZX7WzJPe3AxENJqaZgh2d32Uzzkp9rcuiiFBZ9boa8W3OF60TBBjzjsWJXvJHnhikW bCFLiq/4Nx8tjPxvfoC4j/ZSodE7o7noc/YuY9gIjpw8MCS4FTA55e/wQB5RK0yflizBsdSpsTxD/1HL8o=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=xNQVdfGNy/hlxCElrI7onCyD4toh9iF5bRupZBzDeM8=&c=dvCwKs69RMa1fntonQhoLq/3KExHwpK1RgccvP245lQ7CEZYL 1uAFcerjYcAkAeELdcThf9LS1UYOVpJ33TUvOyTbKN4 8g1C9jZS9r/ ZJJSo3cIG3pc eGaNAQwiGGCohPSGYETBQma2Rj Pzh4jJBCqzmDAvRv7N4hv9czQ=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=/6EBkzD61DfJiCd87ylAwjzDKZm3oMjpPq6KTtcZBMA=&c=0Uisp WYy7oOv LR23XyJ/ yEfAIdUZiSNK9OCHk4P1Sk2autdVFEYjR3341Ixwddvqo5qs9HntS5Uu3h5im4LtBa4LrILPs /m8F3VJFKUcR1Q4tQ7yEX6sFr 1ILjL1VaX Ta6c/YKmi8ywvQI3e8G4QKUunhutIzI6yPr0v8=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=LnJ6nvmXyqu1XrqwYNAIOS50RyL1Sfc0ARZLDE3LVHg=&c=l/M5A5JlHUlVY7oSXrjEgFwh0VFOMKICGz4CZ 2TYd ErAEUVujEG2ycUH/crTWT3D0qHkiJgHK6s1Ct1Burm49NjlD8ZBYxBi6uGgvi3DqAEEO/kYJOF1THydtX1ChcOW7ptDMiiugdE/Sglt7y 9/ XdwneFeWXLciyqmhrAo=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=rn8IP/T4jE29Nc nxksUt9XtMWPk6g zJHgfKZqJO5s=&c=1vZDFPHSWXE86/WY8BgxHyAfNUaFpqiHEJmSRH/MM6HERyY49a NY43MRI3xE StYN nyEkbXxRL1kPdBn/ybaWBQjN0G55U5frr8Qr39gsHOEES1pnRS0aIvImH5hDFWSpZhYxTWBp6 Zwih6gXBvvJs72E3MuIGWgXqQr0RbQ=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=hlD2lms6m IkWUynZhTeuPCKwsCDSyFHBjf7ckhtOTw=&c=3sq4kLBlE8tVDVx YH5sg23FgTFp3taNLda vYcAhF48PT09M zpFalK6gpwMBiXdx7X3b kaaPpfD6IjYLqI7FhVDaylzCLfDevz/F n6A1at 7LpmZt8wVVxAThl/Pf7ZRapIQ8IvdEzBmPuAMXf2Iy2boX/E0fKODRFlZVzw=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=CwvJT3eZxlYmqD5D9oZjOXnr8/GYZsoZbT0v7wyRMmA=&c=AW0Rkd9uwhV/1K6DEZuzRJKjwME9YFoj7pIyR OU517Uk3D7Fi 8ynCIS637L9HQzBIm8Adx3pwHblsg711rQzeOAxiAV9PkDgZySuqo qG93B7w7EwKMEwXmDf45DuVxa 7YWcIfIcRI5RQycEjH4LuQQpejMdIrHhfUo5Go1c=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=ud/iva/lpaO/r92MeZrU1 cey32aYXkufGoUocD0SJU=&c=VZOVcSBrskc6n9pNthuIviYl8SSHIMcincKMGaD8w0oaR1VE8sz0bNQkRuifRjSzX6ZUoWxnrnR5O/Y7Cs3HRQUdldQcPNubEXhKHIBwDq ucTulA6x44Vc8tTJpHgoScGNkxRRsLJNfmAkwyfDPVDZ4iAP Re0e56fY4MlNjlE=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=t kQCLKyYVmdvf42N/2d0Euenm Xi0vT2eXznv49tT0=&c=pXWDGUDlSCjfvOAVz8HuWO1qw11QSUZILGljZfJSBNFvVbjhc73m8/pO9V6rHohgc aNSQ5aWNSAfCmM QuhIr7N5ICnzm1glHwvvw97eeltnLkYjVukwKAU0VW4kpm2fhbW baTS2laj1ablhizOqVZ60rFYv8LxCY7OF4buZE=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=Bd/QA2aiM6QAp3AR57P20PhBC/N481ae7ap0/AP2FBg=&c=6qHVwFKw0Xa7I5bR1NSqPGjA1YCTAzdB8Nj YMd9BkhtPtlCkF/9lTyfFZCzRXsOJe0gLFwwrnXB4k1qX0rjARNoEdpN GtdgziDUkDragCAQamLS09/k7yl7 35gwQDJdGWg6RpMLIVJ5jeItZGk7yw1SbpUNebspqRFBm4KuI=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=/FnUIx9czmG4kuINRWt7jXk lsGyFife js5S9IbReU=&c=ARrjrb0fh4G0w/Qtx8r99PbCiuw72MBDruIt6CkpMF1iiZ2DsatqdZrw93CdU1fXeToihgGNu5q6IJ9lBvRwl9Fg5aQvua6K7V8nXj0/qWqmsIioymGexagFE4So51ezObf3eF9gEVweB6Lp7Sc6IlyVkXe8jiNneWXiKscHtI4=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=dkFddp7uGPeauXkh8Oyw285ICUPRLxQxfGxgjqR2rpY=&c=QQY920tPHRO/RJFZ0loREY Yz59D2BC3afQD5gUGsAmC oYZ8JoCQWumQhQB89xGxxwWS8K07 2 G2fIBENJIQ4YK4Ca uhsf7y1iCO00m4jHfWQ4TdoCkFIR30RhaImO/JRIzrle619ojTRv9Q3sNfLuiyNxm1YL/WMvvLhF o=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=zknGtDRTX77YWVBGpukJazPyE2RopVC 56fbdJ77NQk=&c=6ponygFr9tJosR1i5wZwTadj i0wTlTLOWRJ7NX36EA8F0yGO3UbWomMeGSQ7yRPSL0H3ksPBxpL98/Oazig/MoZB1TqiI8 bBV5rB9Xd8/HXwI 3qRB SFNs0sM1WTn1 AJOrK97YLWOT0Vjd6b5Uha8NW3UAnDQ5m49BzIef0=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=XTRfyYeOvDeLIy6cGGR7qe2gyZSY9BCxZ8LYwvCbxV4=&c=2bBdyBnXdqI/tgFTEDSR4dUAt2cntn87Wd1VPkbJq47VlUNryX36kJBN3Xv96KJgqcSWXv2aP 9BCQ17QZqLmrxDEwoWn66riIR1qzJGgM8EOj5ubE7UIrDxb8ZkuLXJoSGKU9A iz0EFgKGKmS9nuADmhrVC1YEAu3L4DBTwGk=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=xZv18RSkaLI04WTcN3m9g1sVSXx66QMFPqoDZUAdOSA=&c=iroYj4LH/RDVpmLyJdKIr6guWxlWFPx5uSy09ICIAnn4m j/iulObu3OAEoetjMj1HvHxjReB/6DAqy6nmra3PO67F1hzYVeRlS4AH9ZPuGnyBBbG 2IoNhzVy/SSyYLSA9nDfZnGqtG5hDV1aKlfRdMmhdcTuC gxeZLSZ2V/8=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

Remove camstudio.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.