home

camstudio.exe

CamStudio

Astro Delivery (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application camstudio.exe by Astro Delivery (Fried Cookie) has been detected as adware by 10 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from cdn.camstudiodelivery.com and multiple other hosts.
Publisher:
%VENDOR%  (signed by Astro Delivery (Fried Cookie Ltd))

Product:
CamStudio

Version:
2.0.5.a0.1_38795

MD5:
3bf77af335a23acf4c4b13cde474dace

SHA-1:
8add3466bcef8dc474fd74f14551f03e5e9f9326

SHA-256:
5fd969d2957cb7de6c29f04193e22ce7fa711d8b85be39a64c868f58da571564

Scanner detections:
10 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
1/4/2025 2:13:17 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
PUA/InstallCore.Gen4
3.6.1.96

AVG
Generic
2016.0.3134

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.InstallCore.49
9.0.1.0109

McAfee
Artemis!3BF77AF335A2
5600.6790

Panda Antivirus
PUP/SystemSpeedup
15.04.19.04

Qihoo 360 Security
Win32/Virus.548
1.0.0.1015

Reason Heuristics
PUP.Installer.InstallCore
15.4.19.12

Trend Micro House Call
Suspicious_GEN.F47V0416
7.2.109

VIPRE Antivirus
Trojan.Win32.Generic
39484

File size:
955.8 KB (978,760 bytes)

Product version:
2.0.5.a0.1_38795

Copyright:
%VENDOR%

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\camstudio.exe

Digital Signature
Signed by:
Astro Delivery (Fried Cookie Ltd)

Authority:
COMODO CA Limited

Valid from:
1/6/2015 7:00:00 PM

Valid to:
1/7/2016 6:59:59 PM

Subject:
CN=Astro Delivery (Fried Cookie Ltd), O=Astro Delivery (Fried Cookie Ltd), STREET=28 Lilienblum St., L=Tel Aviv, S=Israel, PostalCode=6513307, C=IL

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00B5DEF5C3088901F4214C78F98CA66045

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:kRa3sECG3CklLT80PP1xNJWospqvIF2NWuivygRs74:kY3VCklr1rJMwvIBnT

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9320

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file camstudio.exe has been seen being distributed by the following 18 URLs.

http://cdn.camstudiodelivery.com/c?x=RTl09mn3c1MX4MmrRUheQAauRAihSVDucNL5p39/Ymk=&c=CaiwBR2PTND74VkG1 u52QBLv9ARrmcX01fO8U/fwag8FHfu/XS/cS8eyPIJ56aJJDxAkOrY/KdP2ptnd3c8AQ==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=umKP745iUeXR1kQ8 76q08bG8gCeD1BI/TYIULXbUg0=&c=BpnWK437r/3lvxLAM gJE17eTK7R1mN7Mim/i33goUQfypnmAaagQogRi7oetIgTjrzZMo9/cwbdZMkb6vTsHw==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=9pA1xSmPnrkhizZS/TSCLSH9whoi4djxxgaXmAzGylY=&c=U2uHhK2ThygXyVylX01xI4m6lXTfY1gFnAH80Lsy3b/Ce5Bo55PeNZsdEvlixn08u5vdE0ZsQB9dVZtMtfZX1A==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=cvJwBy6D WFSJcRenP4NJwx8Rm J29dmnCzoLkeQ4WI=&c=ZXjHYVY/KkEFBuxdM7ffWrt6H3aIX0gtBM3ixtIRgKVnfBYNhdx8KNP2LeB7YW4gyCcaSYS/zmL5S4YId/PGQA==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=qcQ3gM82DXH9eSikmLNs/XbkKE1Nasio5VDILYocbHw=&c=0NgQd6k5/4xS3cxlxrhQWCLoqxXwhibMopO85aebuK6f89 CNQTwI8oDxFmDXdsRVv/vh1eG8XTiKXzshhdumw==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=0DW cicOje6bwZvOsiOAeJ/HcAlUQLkizAsOPzk9ucE=&c=tho6j9oApZrtOTk/HJiR1BibvfyZA9AfOeRP278Z9dLOhgPmCJcC5ReZmlOBjiwfB5B1tVE2jT5vnmFmu2terQ==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=Q dBYyGezOfIkU376c3GGv/vPBgNny7y4YXOENiqEhI=&c=ffZBHVkZrDVh/R8p5rL0kZzPAE7PrBNIqj619LXTH18FTzEGRoHHuIDllcIyl77iTK9VXUeTQO14Q7v uqD2wA==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=98S/0ZENUU96QwOWnAsjzyQZJGtlgIY8DCY2WzHS7Sc=&c=t7ijo2bhfHzuaS/tRbuJdQa /o/FHhOpaVhdrIwaeyrAp67Za9o9hshcrPwtN89SyRmyJdr8Gw63F4gP 4APGw==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=FKK7iHG8CgerJHqTprzTCbFr1j6NhU3qS2Xu4NdqVkc=&c=lYp8QMl9CGG/65BdIiymWTfy0Iu02FfvepjpLgnA0TG73bqXCSycnB3L/RMxoPNodUQKX4sz86lHmgjekvVF9A==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=pZmeOpMOSp9JpEq43JJZOn0a5rhGKtlNCviuBlMKR 8=&c=f37OnkgZg8XVXNLhnYmIELcBkKB1Y4g2ifXXyb6q/kezgEmnTcjmT23vQZ9sFsyENlBBScP6zutm81C38uY5Rw==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=wQ2/ZEevW71Bt4MbnX9JSKHQxEwk5b5AjcdiUF43o2w=&c=r80tLySvDRiW QAIcUXWXQBKG2lbJ1z6pHzJWHWIgmiUw6q3wA98nZhQFMsM4Uc9cOKwNd1GvcSO6/Mh6Pkatw==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=dPxiEfqxA0VUH7iDZ7a1OZlW pbEgeyalBlMruf wvA=&c=VoUM3Uh1JkMIM6Tr7waF1rRsaZAkSHGqmuAbIpXZZHp4ODnuSOWBJs y5faLcI92RUy5yn/14DqUTZy7c3XUDQ==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=cfYM Mw/8CaarggLfzonPGxXwQKmq Q0heyd/q De9E=&c=3K Mudl0cPQ7WDmmRemM 1McXHITsCF7el/82RGlxBQSJvwFHqh7Sw0bk9ISdwg2uEIQVvF1kQOQX VYPT7HkQ==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=VObEO4DWQzDfeWKOsPurUVVLbY6d/OEip5HiFr4exl4=&c=QgUctytMDjDrdGVuCQr0EytjqcJ0Z40mZdJiN3Eyv4oA/1EwP9ZZTLUy1ByK5NQXFbqL 0L2BZTBW7pHNSEsJg==&downloadAs=camstudio.exe&fallback_url=https://s3.amazonaws.com/.../CamStudioSetup.exe

http://cdn.camstudiodelivery.com/c?x=10aVGKTAnDmmpGYgwUW1GPdtTVA4hrm68b/DnxcPalM=&c=VhjhO63lPSpylkRUx1eWTBe1h2d6sXMdURhTwBqFP2hD3Nk/LymrMNqdIkCI7dTG7Q8uXHVKUFIKqILF3UE49Q==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=GFZpByaS9qpGjOcN5EFpooAcamAV2xP7wD3slOczVjM=&c=67eGp4alrBuXIP8vkHAz9PAYjpRY3yTU5DUPiKOY4CZYAq46K/tnedI7qh/zu2UsvfMFg CXWvOh5g5vSAnqKA==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=0vtMu5hI4LlV7CrF6ui9kxsyXRdaB4u6hq5cYacZ14k=&c=n1mLVKCcpI2Lnh3shNsQoPHm cCylTJMK2EWxXn8h0KRxPEKu6eARqdryqB6DgBFervc hfwo iT2YHX2l7Kpg==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

http://cdn.camstudiodelivery.com/c?x=vlZG9DGwBcWQv m1 e46IVPXNCPV7n60o7dS FpXD0Y=&c=zShLscsvdXMnW2c5LiFMSXicNx5GWNd5OAJ/1524kIlssxonb pQq0b60KQw07d/bVIh3QVOvaonF2dmXTDGBw==&downloadAs=camstudio.exe&fallback_url=http://www.camstudio.org

Remove camstudio.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.