camstudio.exe

Path Quality (Alpha Criteria Ltd.)

The application camstudio.exe by Path Quality (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.giftcapitalbyte.com and multiple other hosts.
Publisher:
CamStudio  (signed by Path Quality (Alpha Criteria Ltd.))

Product:
CamStudio

Version:
2.0.5.a0.1_61161

MD5:
5c56088f954489415d4a64efdc53fd4d

SHA-1:
e6e97247dd8b93844201870535aeec3e6a20e0ed

SHA-256:
efab336c26106e0d19e14f6d193f8973ba9565e1c8aeaf48f573a97e3bc2e18f

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/1/2024 8:26:00 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.7.17.8

File size:
988.6 KB (1,012,368 bytes)

Product version:
2.0.5.a0.1_61161

Copyright:
CamStudio

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\camstudio.exe

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 12:09:15 PM

Valid to:
8/3/2016 3:53:56 PM

Subject:
CN=Path Quality (Alpha Criteria Ltd.), O=Path Quality (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121865442A968BACB1F4EC1956476A3AE8D

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:mTfX+OUopkvQikg+G0uJpX8rv6Wa3BmVTf/XvQyMBTlP0QjcpMXVJoa:mD1pkvqkKCWaYzGpfL

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file camstudio.exe has been seen being distributed by the following 19 URLs.

http://www.giftcapitalbyte.com/c?x=BQUY5qRl6Ap4hdCk9y1tn8QMnvAjNDV2ZTbHCJhcPVM=&e=0&c=WtYbtThZS1XZDZ20H75a1m9B C5urj0KR3T1Hs8h0hblitWTDHXO1ydvH6C5efgDhLYu7nrn5X32Nd9g6w9ZNFhKiM9l/lZWgnHOm4aNRm0/oA71mcGdZFiplBm3vOSgmQS6APQg8j0tMSArE397dIv55C1h 3bX2Aw9wqYEZjI=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=eyZuhe5auJ9JgXbXNpYn6UzesocfEpKLAat529T5 5E=&e=0&c=ZbqbmK24te59h73Yl3dZY0gCwi 0PS0PArIDASVqXsVoI7OphU4cIRqDFYoWRbwC/Ywj8aTYASJiYc6DfnC5NfeXGu3x0D8okTCG1 0LxUjnIhKP9CCpfU0 rE9oqd6zoKz7Hcf7ZcQlqN3oiPoSRFBbCoPHaJYAMm5BdmkV02Q=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=ywf3ZUqLBGm2LKGnluynp ukYtC40HufH71y0A/NuNg=&e=0&c=AWewyTimYrGVQXSoIf1OO28vvMnUiHhoYh3HC nZVT8yv3K5nXppNfVZeHmaceVtlGy6 6BOc1ct06Pfax8l8MlHxE8SFYwU1aYbssflZtRimtWDSWkPcHT4ydgdsf6bjlv37L0cAajwwFajrOXe8hqRwfzYaAhqRHiVGFvejBs=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=Wvqp154Fu1kVvUGDv0dtRgG7ZvB4eLSTUNnt65bNnkU=&e=0&c=AT CEEg5oUpt47omdtCR22CY2nU/EDTtGH0SpBOoeWPKwCC1R3UNwwNuhozjBQmVsrFjjaBIhKEUL9/Wkwm Y72x5/cGcTc4suFsfpobzYoeSHzVkGRd2VJxDj/PMsQGFxNNdodLEx1c6KvSuF2JW5WJ 13I02EkOl MWWl6hV4=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=7sy7/5VxHGUADA Al9tTsPNX92L253huMuaJcUp2VS4=&e=0&c=CGZJJBCymFVt8do6lqDgzlFIQcm0KOJXoipFwGwm6efyB6RRPNEIHXTHTBi3CkAO8liQbbFxoFuN6R6Vc9ZG9iC6L6MPMrEJ5xfu4KV82G 4k2iJnz3xLjvuFK2Po0841Y0Fqb7nUIFDHhZ9WcB7kFXpNotxkjLm15W0E2igAQ=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=m0bJBB5DtVIeXBxjMpUJdq6ZY96 gRSKeRCd8aCXFFE=&e=0&c=hFkpd/jruAGSg4GeAxn9fPitLsxZhrQVwrHbhH6KTlrXbRCt SknJ8UNX7nizHG1tbIl3QXz3CCXOAN0rBNUKfzCCbkPCTxVNMV8Y5/YpovtmevVxmC7PRt6i2VrFjye8Dz7y19qF cDw zGb6gasM2gWs b4XkTgE gScw zog=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=6OHrynMsiC1Yl/ZwvIoodYyU/CWjcI88g6MY/rgTPgE=&e=0&c=knKMxAUN5Qaz54IEDq6M8CLgxjjlr rGngIfFnakXc FC0epzvwEZnWsbYOYZmd4MUGN3c25VOtXimcqehNCZTPRf5NwHcy BIcBV5o8SS1njx8ufCcWSJEHAleRz7uU/p/tRwD2uksb8hq7u1OScN3lazjQEQeFIIEVuXQIuBE=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=NMPJ7MDdtPJCGNEldB7lTegueKg azlirjR8dcQqZ2Q=&e=0&c=W3BStMqvYK4g h6I9XKn UJDCoQQdhEk0UlZvohy6B8SRbbO9wibMAQSImUza1LYW/CI5dhBTHrr0ywLVwKZ3VIsqzzf8sjOK9O58oCd1blMZYx4cp6O r3JsJrw7he5Ar/TdCHiiYwwGOR xsf8TRDEEQ3WrZ9WlvmRqqTnRkg=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=GdaL0/ftUM4hAJqCEdog 6F8yEi9Kymz IFn/u7XduY=&e=0&c=c4rWEvZJGb2rPbTmO0YTXkOVGb3dm086q XCrDER7T9hVZ00Hy48TuC7JdajzQkA4TSKGiV7NbOymqVgELvlV MqOj4xv2yQl/x43I0D7UbC19INUy3bMJzR0OMtzOzc3iLgQI6obJUHE1nqRcHtzMj2gaRQ30EJj1kHPGdxIaU=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

Remove camstudio.exe - Powered by Reason Core Security