camstudio.exe

Path Quality (Alpha Criteria Ltd.)

The application camstudio.exe by Path Quality (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.conceptspresentmeta.com and multiple other hosts.
Publisher:
CamStudio  (signed by Path Quality (Alpha Criteria Ltd.))

Product:
CamStudio

Version:
2.0.5.a0.1_60682

MD5:
9567b602f947b8beb9e28a35d8ae9d46

SHA-1:
67747ac3b20cdc26b72ede6b145994e2114bb404

SHA-256:
44854faa2fb4dec61c9d8e38bf275e5644a06042bead33b7350610c34ed403d9

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/1/2024 8:33:50 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.7.7.13

File size:
990 KB (1,013,792 bytes)

Product version:
2.0.5.a0.1_60682

Copyright:
CamStudio

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\camstudio.exe

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 12:09:15 PM

Valid to:
8/3/2016 2:53:56 PM

Subject:
CN=Path Quality (Alpha Criteria Ltd.), O=Path Quality (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121865442A968BACB1F4EC1956476A3AE8D

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:r1QPcnADHUAApXfhY/91+Q/C7vMFvaBEi5wsItQ:r6ZepXfDQN17sqQ

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9258

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file camstudio.exe has been seen being distributed by the following 17 URLs.

http://www.conceptspresentmeta.com/c?x=AAarNLOU7unSmVEkpee3V5ho2lCx99vinDwINeJs/78=&c=l kn/469ChA/AE 4lNKePgcwnOjLng3dhWP2f6YQ7jfS37PUmG/vHVhH/Gpa4IhmIXhH1DcloaU qKwephlD64s3zpCDCr5E6DYZfnRzPscnIh9BR1E0okT67HDq05oOFk8qJpz6h2ZFovGLAS6Y8HJ2Honkab 7NG14L3F2xWw=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=0/ax5w3g/m14FLt9dpJ891iJdU0MJ2zCOedPSNM2OQs=&c=u7V4qLttM8V//zHPjj03g8F0bDomfTSGzyIWKuZX3JKSfMU4jW2n 6heZouUaKb3qIxBcha8S4F7hLqqHHTeGfrc19 lJymLLJdJcPHON/NDIENPw1iTSJolixOYpHV/nIGpOZ/B93JvfHxDGsCywVpGnKD/t92Y00qoNsypyoI=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=BIq7ZzWH90V2TaUit43LCGyvMhqiQAbLHqu8N5fAI8s=&c=//75lZic47xirn2x m5YbcZX7WzJPe3AxENJqaZgh2d32Uzzkp9rcuiiFBZ9boa8W3OF60TBBjzjsWJXvJHnhikW bCFLiq/4Nx8tjPxvfoC4j/ZSodE7o7noc/YuY9gIjpw8MCS4FTA55e/wQB5RK0yflizBsdSpsTxD/1HL8o=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=xNQVdfGNy/hlxCElrI7onCyD4toh9iF5bRupZBzDeM8=&c=dvCwKs69RMa1fntonQhoLq/3KExHwpK1RgccvP245lQ7CEZYL 1uAFcerjYcAkAeELdcThf9LS1UYOVpJ33TUvOyTbKN4 8g1C9jZS9r/ ZJJSo3cIG3pc eGaNAQwiGGCohPSGYETBQma2Rj Pzh4jJBCqzmDAvRv7N4hv9czQ=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

Remove camstudio.exe - Powered by Reason Core Security