home

camstudio.exe

Path Quality (Alpha Criteria Ltd.)

The application camstudio.exe by Path Quality (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.conceptspresentmeta.com and multiple other hosts.
Publisher:
CamStudio  (signed by Path Quality (Alpha Criteria Ltd.))

Product:
CamStudio

Version:
2.0.5.a0.1_59625

MD5:
dc5882298ff02ff03c078e153e139310

SHA-1:
dbd1f256be6866356e6b9015ec5429a7effcb3f8

SHA-256:
a0512b5b04c7a2deac330fb659ee2acae86e9a0dbcd33d2dbba40bb1c4c5b58b

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/1/2024 10:29:47 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.6.24.2

File size:
992.4 KB (1,016,216 bytes)

Product version:
2.0.5.a0.1_59625

Copyright:
CamStudio

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\camstudio.exe

Digital Signature
Signed by:
Path Quality (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 12:09:15 PM

Valid to:
8/3/2016 3:53:56 PM

Subject:
CN=Path Quality (Alpha Criteria Ltd.), O=Path Quality (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121865442A968BACB1F4EC1956476A3AE8D

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:OdvZpHz8mQeX6GSMXdGDMG74069YhPtlvcAb+Hu:Inz8n/uGoGk9EeA3

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file camstudio.exe has been seen being distributed by the following 13 URLs.

http://www.conceptspresentmeta.com/c?x=JCLUrz8RuHI Ag5Ae9rcgkwbEM4DSLaIrLHf47tpw/Q=&c=ENAJzyMucZBUBrSChbNwrtkVJBAlBpXTmj U8uE/j9idBHDc0mZa1rUeN75vFdUG5hMD1aJU8aoXAhu5S4BsgqE Oq/OyHBxV3LihkfkKu/3k81F48QEuhQLkOXXPyyY&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=D90QtGs0Gm9LOToUTRi2KuUU3lFB/9GK86 O0dAjjOE=&c=9g0X5yE joaVBVdWjVo293Z0xEWaxpvcvEwnuJm6uTQoWsw6zv3XShxGDu5pgBYv F9ZbmZscjaZxJ9DS84Zls6pdT acf YWW6VY7q6Q7B//3gKRZzl adNPGPbHXzX&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=pgohz1MhMT4yPC06mow8SzwvSEErh19thG8JC2cFw38=&c=CkcHD nHf06HJ/Bx7yzCJOZD7HSXhmkGX9kExbALZRn7iEYgP7XfGRa5dOxALdFcklh4e5usba3k89qVoYgD5OVrbrUu9mfL26ebN0dz6ki0r0uOnPomEkMKrOWfulRK&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=XUcuJs998d/gTxB4 vpf1nWwWfzYd5EA1l01hMVEnZc=&c= pwOyJeLLb2KpMhSKm7WJZzp99PI42nwI mseOxWnPrMLJU0N0sBIrQp3HMaYL5Q45yK6DfQUeTgC05Qq2iD5moPE2gs7bGpEryEvxFiyZxjCooa6CtSawtvIXhanP1N&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=UI3gLLEAdy5w8qhp iL8Z3Y4HW jHBS3GmPWFQwUzb8=&c=TcZ/s1prU3TUlk6XIn2vpZzC67pmUaovFsRcYyUwF1Z20wupl9ewO/DmkUhUyihhDuEQLGfEguYavgR3FtchX46/sHUoaHsCfkd2mXF/PmFCNMH7VaDwmQN01gJB9xji&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=5RdSrQohMzQ42/sKAzUkmxKnd6KEu7CReUZgYJclZ50=&c=4UqrbvAOqUkrIbAMMpmmiIFwDjvhUEQFZDtujcYwtK3ZsTVMm/foBLAz7TqDNoDBpi6asPlfGQ0XcrTf8ZdNWi2C1Ie IDReT9TmTECQt0jD4QriLohO1rXuJCYE Hyy&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=byiv1S7bBDzbWAz8ux9NclhzA9Ibx2kTzbN92 Zxn7k=&c=7N 54EzF2hzRF2c6KLKZXqDzDz6yguONPcAL3xmLOHr01kWDhGwINC9MQ9xxFT74aIjo8zg0A2v7 gOTKdbAkOpeFYg3j6InQlHJ3Teq4x9U//BKMk838deBQmX4/xB0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=6BdTNmdO9hEIBf/Roca112ZI/6KR8FpVColCcJKfB2A=&c=2dhxe/wPCjBxfiUmXRcYU9RyjQJeSw0sEdOlJHjrzAP/V5T2uEjeJ0Tq4gOdLkTluIARHtk8SlbK1EFNsppN9iz9TB/QIcQ/mePRgIDMva5ehutveOfev4teDx9cmRU4&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=oMasjGdvyg2zsROtUsqRQTk5 uPKaqCVyK4XbvpWkCQ=&c=HoFlvZSxLGeQMAH6sDSdK42QyuPh1srpfygoP9EO3ijiCIUCMEkunj4SYJkR/B/TBBvwIBEj3lwcJ1E8eUvIxiMyU9a305E2GvfUNs8twckSy77wBIyGJkY4zTZBGJC7&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=WFiC2tgJf0G2dvqkncfxABhrs3vVHZQmvcFlVjWiDGA=&c=z7ulxPN7VSC0rPlycyTMVP/K4fPsjWaKUWAn/Yplso0RFZPGFWALLKa8G9HMmwCMGCe61glrnh7hitdifG14mEVgikCPtgzATwhS30HcyUw b3amGDzDkh3mo3bGUevs&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=NNnmfaXgErdgf7QoBdVXGf81oMi9r7/If2mgxRSweaQ=&c=dzgkA0IlQsJn379JsdvawLWKXH8O/3O4rty32yjMIz3MjHsPmyYRPRQQbEDKzeaiajgA1L7Ck17twYA30H7BwB1YdVsq29pjCO9xlwG VHT0X/ kPv0Q LlqoPvl9w02&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=xC1FkaEQCevdMSmFVLdplFKWDp58jy0rdyiiqtIcJ18=&c=BgHpBVnnjzGiFm/Ue/QGDHuqHHn6MD63AbYtTP93EqEMcgseKvLv3Dm/UhGypzo8Jql6SVtRi2P74dlf/YEIljRRxSNWrGQ J0x46//gLqth3OiYb4DOQ1ikwa4tcITW&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.conceptspresentmeta.com/c?x=Ia6QdnCh9ekMkKMcg2Kdr2WWGHnPHgz9Q3RXB9a08sU=&c=LKmczNKcbdknZuHZoN2x4OxlyNL6C0WBO/CyVNZ7L8ePYFEwrS8kNtW19iR tlwzDo7aX1flIlZg5poMitRM03cPAcGKINO iXmiql5/2Wu 305Gp15W6O116ntgfb 7&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

Remove camstudio.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.