home

camstudio.exe

CamStudio

Astro Delivery (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application camstudio.exe by Astro Delivery (Fried Cookie) has been detected as adware by 10 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from cdn.camstudiodelivery.com and multiple other hosts.
Publisher:
%VENDOR%  (signed by Astro Delivery (Fried Cookie Ltd))

Product:
CamStudio

Version:
2.0.5.a0.1_39797

MD5:
de04bac66137448a46401f5f306696bf

SHA-1:
7e12fb8e68ea1f280125e58c005412d2ae457eb9

SHA-256:
f35b362aac09b9fa63e7a5ad6c5886b61eec17423b3910cb25402439cbb0d85b

Scanner detections:
10 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
1/4/2025 1:34:09 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2016.0.3111

Baidu Antivirus
Adware.Win32.InstallCore
4.0.3.15512

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.InstallCore.49
9.0.1.0132

Malwarebytes
PUP.Optional.InstallCore.SID.C
v2015.05.12.06

McAfee
Artemis!DE04BAC66137
5600.6767

Panda Antivirus
PUP/SystemSpeedup
15.05.12.06

Qihoo 360 Security
Win32/Virus.548
1.0.0.1015

Reason Heuristics
PUP.Installer.InstallCore
15.5.12.14

Trend Micro House Call
Suspicious_GEN.F47V0511
7.2.132

File size:
952.3 KB (975,128 bytes)

Product version:
2.0.5.a0.1_39797

Copyright:
%VENDOR%

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\camstudio.exe

Digital Signature
Signed by:
Astro Delivery (Fried Cookie Ltd)

Authority:
COMODO CA Limited

Valid from:
1/7/2015 1:00:00 AM

Valid to:
1/8/2016 12:59:59 AM

Subject:
CN=Astro Delivery (Fried Cookie Ltd), O=Astro Delivery (Fried Cookie Ltd), STREET=28 Lilienblum St., L=Tel Aviv, S=Israel, PostalCode=6513307, C=IL

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00B5DEF5C3088901F4214C78F98CA66045

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:i0RXxeFBii/lx8TYZebXpkeR7EQFkpkhOsmFs6tke3:iuMFw2lx8WebVTQV3

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file camstudio.exe has been seen being distributed by the following 20 URLs.

http://cdn.camstudiodelivery.com/c?x=OqfpE6N 9 y9aZiEFy2 ugpLIKBy8 3SC4HqqDlJXRg=&c=jIO A0LyfXZx/uneKiWSXW1EK5pCpvHjJyUh9QhYNVrSTPGkaP1Uql45lHz/nWrjLYlyYXaH9C5w6ztK3cW57Q==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x= qOQS1ADKyMrtmaihYOeLS0tvVjVvsYZAmxIGTwPy6Y=&c=DrOzM5ybgtgE9dcuVqn9A22OTvrSCpZe9WwHmYlpq2 vH6 R478A0PzfZ0W19BhK9OVr087CWjgbtRYTvEt FQ==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=7MbKcA9o8UTwg9HnPiC2Do51tC4eemkma u/qLbPYpQ=&c=Sqx0VM1wopI SB0Uvm7f60vapr1l9O7f1OpW7sstY2XNWj0s8SA aRsyoYeABhR 7Y3SmmIV8TRLRmWyJ/c/lA==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=sfvQeVerTH93x/oaqC3gIbZ7Ld/Q6cbnWMJPZot6ElE=&c=i4XKW5DexhDVRlSVsDIaZf2hcGUGMto4nuhqTnnSwBFxMcb6dF/uBT/N4S5Mgfq/OPUGlBFjmpTCKAaL3rBw0A==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=RtbmGYot8jAUkZjS62QdbB1F4hzPgD7jLTS 0ciJuZM=&c=lrT/U 4TrGv6Nrk7aI2q0J3826YlzHW98jlB9Q1V4oDISWIq1HpuS3GLYV5tcseHzc j1ZV7FYv1y0/QF1wSZA==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=um0piKcEUm rsvsADGJw00nTk2ip9XErsfryKyrlEFA=&c=cwy3C0G1BIzTxnk V6exdrUubF/X445DRDc7uV59VluSPlNYvgGVqDl3TztHl7JIH7BsnlPstMfdYPfC5n3t A==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=h7KstBcot62ekrQiFKu6T0vy9vnKwfZbQTl78jX 7E=&c=WXZsrEFWNiIMW gEDPx8gbtU3Xuet8UxjHweFYOpZ9gyZ9RcZIXzHfj6GUEBSVqfiK T9DvgQ259PxIM19AoWg==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=2dUNwBEkiXZXllULz9bkuPqIaxzbSfZhv1bjekmoiAs=&c=gHK05HQxPny8NyjpXePid7M1F08wWj/eigCN3xsVOzVChQcN8EfV7I3 LIj7NeiKSMOwwTJsP2sQ8JVkoubGsQ==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=O7Gc NrCUjGW 98H4XzPkvtWXUY3 xCPiHc4lgJxwwU=&c=oOoY4KzKPfenkUkSR/ACVifINpi4D5/yC1MG2yurPVZPsqkoEYKz5unKIvdCRN6pQ7mVFdmpWOc7r5CvMvTEPQ==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=5puFlSMqsXNPAd3E6If32jjSm mBZbZ46XaMZaP0yMY=&c=Tnz2PdvxOLl3eHXqF7GrtGbMbLicRtNRLoMhOHAbjgDkttU1jHdLmXsQvLU2lC1XD6sXl4ogFANvrAqsfw2Y Q==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=G5RLgQH7Xj2rXQS TpkFSg6W0ppYAQ F6ZV1afC4ijs=&c= NlUGwGSkb oJLFx/QscsaE1GKI4Zo35P4o0Q/k2UWIGOIb0PPSc5YcEt7MUm7TnyYTUDs981Xa6m/lIRARYw==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=mGXUfqOgIiiSKxCcmor0IVQUTAgzOI52M6LUfsgA1gs=&c=hfp/WeR/Azhs3QL92rj7yVojcW4dLDB7D2Kj7pWIqYRb6B/NASy8Nvx1pb5OmIJu2PZr3EHqd/kjq/fckZbAQg==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=F9xGH5q2ifgqMH9a8Y5fBg0bzKvNUwthrzni9vxQX88=&c=lzXZ6JGXB/4ZzcDDxAQpqW4yWZ3uGDzo YVM075WZq53Fs jJCR1JWuWH/TBM/Fgwmq8R2n yfHI9Pk5XUkRRg==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=mV6DJEZss9YlqbNtI0RyTEuBZi7S/ap0jZfFlw1O4nM=&c=fBLB4/Mcs zuL6WtjQokNuNf66ZoS5gcmFBoXCQIT2nGAuWwX PRy6 LVSv4/NVFqNxQyj5lFWQoPYQanGyPXQ==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=hzPWMspFp/yhax4mvpVdFQDncsTnKMyonEOqzmh1uK0=&c=3MeA6mh6scwg6QKGic5brpxAB6JFKcV0JvPmS IvocVzHJcw3Y3nZAR2v1NgZSOT8KIP8V0TzHJEnqv5nC62aA==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=2iQk7At drRKYZOYO8fDbt8FY2wN7KPHkQ276ZLvrFc=&c=rr1BcrSqiJXaygHfT/F CGHkh4HgRKgnSNHLEPdCfabGUen02hgd 5zHofQWJMIYTrZ1GpQnqkwCyNPIyUyN7Q==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=Isz74BHmowOIojDFYgQ8pFMCPMINYAUeuzXfF xdatE=&c=cFKTX9fAdZ04ypG47DpuF7tv2mmBW/gQtqu GeB7LOGQvKTyKYujB9T0YqGD7LJij8XKqIpNNw8WfTi/nOI/wg==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=nm 2mGF9JI/oOZ6zTVogF2yFPs6VHctJkfcN/VUe1NI=&c=feuYL4Xru h86Ia2KiqfEtocLcqML2mYoKM K2uDwlJNuUCr6CW5maNPCEuFYyxvgVWQvidjTYaf6I/E6ShhXw==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=kaJe SoeQ62Sa dnnepkKug0peMmu4SEcU2QKpuvvM0=&c=I G 1iX NBzTM6sHok3wCVxikc1LqPTq5t4jH9vvvp5RooZQxprreqpg1c6BNV67fgvWl WqtaqlEy0IqERvOA==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=/XEl2nRkZyv6IrYqSdBdwcdWl2yNzlKPaOUMxi2nmTI=&c=86odjo10zJug89GHqBax4BPeXP8IcxF74/i2imPcYyW5UptZN4mcLuSEBHsUiKngKx8CFFDSm8IZrmkcbHDm2g==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

Remove camstudio.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.