NoRiskClient-Windows-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NoRiskClient-Windows-setup.exe
Size 16.8MB
Sample260716-phcspsgz3v
SHA256 39e43feac4261552a6989b39f66fba2c5c8b9de21d1806199500acb69f7e563f
MD5 6827a2fa7767364ecce4aeac4f91c66f
SHA1 e08ce7eb804ab3a15ba66fa9ce11491b30d1deb4
SHA512 c371dadbb38de06482821210987be001af7caac5f47ac9c1d4963d827a02307c9d69617fbe5ab2aab67aa971c7017c448106d390272f2ccfb25e198a70401035
SSDEEP 393216:udYmfp4O2fg+MZ90Y74IBqqI4So6YM2pRNLLPu3NWse6d6FGi9C8lzD:uWmfpfmg+jY8QnLbNLL23wFpZD
TLSH
T127073312AAD7C1E4CB03EA39E17F4BE37618D6AC49269F8E55F0CAC043287DADC1D564
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
NoRiskClient-Windows-setup.exe

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/noriskclient-launcher-v3.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
NoRiskClient-Windows-setup.exe

File Explorer

NoRiskClient-Windows-setup.exe

.exe 16.8MB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 30KB
$TEMP/MicrosoftEdgeWebview2Setup.exe

.exe 1.6MB
noriskclient-launcher-v3.exe

.exe 27.0MB
uninstall.exe.nsis

24KB

NoRiskClient-Windows-setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 39e43feac4261552a6989b39f66fba2c5c8b9de21d1806199500acb69f7e563f
MD5 6827a2fa7767364ecce4aeac4f91c66f
SHA1 e08ce7eb804ab3a15ba66fa9ce11491b30d1deb4
SHA512 c371dadbb38de06482821210987be001af7caac5f47ac9c1d4963d827a02307c9d69617fbe5ab2aab67aa971c7017c448106d390272f2ccfb25e198a70401035
SSDEEP 393216:udYmfp4O2fg+MZ90Y74IBqqI4So6YM2pRNLLPu3NWse6d6FGi9C8lzD:uWmfpfmg+jY8QnLbNLL23wFpZD
TLSH
T127073312AAD7C1E4CB03EA39E17F4BE37618D6AC49269F8E55F0CAC043287DADC1D564
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

40:2d:64:81:98:22:29:89:9f:65:cc:58:d3:b2:1c:4f:ab:fe:b7:a9:9a:ce:5b:15:8c:ce:43:e3:73:d1:46:a9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=HRB 755138,CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.3=#13024445,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.1=#13084d616e6e6865696d,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 11, 2026

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

56:b6:29:cd:34:bc:78:f6

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2017 - May 30, 2042

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

6b:f6:1e:16:fa:31:f4:d9:4b:7b:2d:91:11:0c:79:65

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Jul 1, 2026

Timespan

Feb 2, 2026 - Feb 2, 2027

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/StartMenu.dll

IMPHASH 80469f6834e579db68a646d49780b9d5
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH e6c3208e90c430388b2da3b455c174ba
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

$TEMP/MicrosoftEdgeWebview2Setup.exe

IMPHASH 7899cb8ba886a0690bdc28d8b481bbd1
SHA256 19dc958d4aed6b0a5e2acf402c3f85ffd73cb38a46184bd8d25afb8bebb6a60d
MD5 2a4dbedb7e8fcda02f2ca952f08f7392
SHA1 212b1328605838f73753e855163f6828278e8116
SHA512 2cca41e99369d52c67b6109274f8e60a423d435333bf781d2224a2bcc32cc8e786678b0612552cc97f585ee1674979d4313ca1a58de296339a98c0039d6b7b94
SSDEEP 49152:NiiGK3juTGz9bFhdy5fXzNdjCzxDGL8YeC:0izYGz9bFhQPdjWSF
TLSH
T10075122575E08030F6B72A3099F599B21E3DBD715F71968B53821D2E2E30AD1D63A33B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

PE Signature issue

Digest

a1:84:d9:7e:bd:4a:09:3b:95:0a:07:ba:f2:f0:ba:5b:1f:10:9e:01:f0:97:a7:c9:e2:0f:d4:93:8e:ab:e0:e0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Chains

Jul 10, 2026

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Digest

a1:84:d9:7e:bd:4a:09:3b:95:0a:07:ba:f2:f0:ba:5b:1f:10:9e:01:f0:97:a7:c9:e2:0f:d4:93:8e:ab:e0:e0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 3, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:32:4e:ae:a6:30:09:6a:5e:7a:00:00:00:00:02:32

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Serial Number

64:57:97:41:81:d1:09:95:4f:1c:10:95:8c:65:4e:63

Issuer

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 15, 2020 - Dec 31, 2039

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:13:b0:43:35:66:cf:af:95:e8:00:01:00:00:02:13

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

33792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType RaiseException LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW DecodePointer VirtualProtect EncodePointer LoadLibraryExW QueryPerformanceCounter GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStringTypeW CreateDirectoryW SizeofResource FindFirstFileW Wow64DisableWow64FsRedirection RemoveDirectoryW GetTempPathW FormatMessageW Wow64RevertWow64FsRedirection GetFileAttributesExW GetDiskFreeSpaceExW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW CreateMutexW WaitForSingleObject ReleaseMutex CreateEventW SetEvent CreateThread UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery CreateProcessW GetExitCodeProcess ResetEvent WaitForSingleObjectEx GetSystemInfo LoadLibraryExA

advapi32

RegSetValueExA SetSecurityDescriptorDacl GetAclInformation SetSecurityDescriptorOwner GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD SetSecurityDescriptorGroup RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExW RegOpenKeyExA RegDeleteValueA

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shell32

SHGetKnownFolderPath ord680 CommandLineToArgvW SHGetFolderPathW

user32

CharLowerBuffW MessageBoxW

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

noriskclient-launcher-v3.exe

IMPHASH 9a948c3ff28f8a5918fd36177f87a0cb
SHA256 669b62a37e9923d569f6aaa01c1ada6a7c6c6779947f68733f0a324a26521cef
MD5 8ca9a7238dfb4d00c91f3a5da704360a
SHA1 5631672d41f17fc8673568e215296d882b72cef6
SHA512 594744eefb5fd6974b5d111b17cf4ca69e673efad5af2e713c43ca74de5e30f80ad7be5bc7a82a4811722e0ff487e3af3e6b33a494f7922a48a9dbca23c1ff54
SSDEEP 393216:F9WW+CgBObpvDrSyNXBcW3z6j/MOXxlgyxD:TcxBOdayZeW3z6jXXUk
TLSH
T10E57BE03F29181E8D09EC478835BEA37FB76BC894524B25F5BE45B212F29F50AB0D749
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13245824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

noriskclient_launcher_v3.pdb

kernel32

Sleep GetCurrentProcessId GetProcessTimes OpenProcess GetProcessIoCounters GlobalAlloc WaitForSingleObject GetSystemTimes VirtualQueryEx ReadProcessMemory GetCurrentThreadId GetExitCodeProcess SwitchToThread GetComputerNameExW SetWaitableTimer GetSystemInfo GetCurrentThread WaitForMultipleObjects GetModuleFileNameW GetWindowsDirectoryW SetThreadStackGuarantee ReleaseMutex GetSystemDirectoryW ExitProcess GetLogicalProcessorInformationEx UnregisterWaitEx ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount64 FreeLibrary WakeAllConditionVariable SleepEx GetProcessId GetSystemTimeAsFileTime CloseHandle OutputDebugStringA OutputDebugStringW LoadLibraryExW GetCurrentProcess GetSystemTimePreciseAsFileTime GlobalMemoryStatusEx RegisterWaitForSingleObject RtlLookupFunctionEntry GetModuleHandleA GetTimeZoneInformationForYear RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue LocalFree FlsFree DuplicateHandle CompareStringOrdinal SetHandleInformation EncodePointer SetLastError WideCharToMultiByte lstrlenW HeapReAlloc GlobalFree MultiByteToWideChar LCIDToLocaleName GetUserDefaultUILanguage ReleaseSemaphore WaitForSingleObjectEx GetLastError LoadLibraryW SleepConditionVariableSRW HeapFree HeapAlloc GetProcessHeap GlobalUnlock GlobalLock FormatMessageW LoadLibraryA GlobalSize TerminateProcess GetModuleHandleW LoadLibraryExA GetProcAddress SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx GetFinalPathNameByHandleW GetLogicalDrives SetConsoleTextAttribute SetFileTime AddVectoredExceptionHandler FlushFileBuffers FindClose CreateMutexW RtlUnwindEx SetFilePointerEx SetUnhandledExceptionFilter InitializeSListHead GetVolumeInformationW GetDriveTypeW GetVolumePathNamesForVolumeNameW FindVolumeClose FindNextVolumeW FindFirstVolumeW LockFileEx CreateSemaphoreW SetEnvironmentVariableW GetConsoleScreenBufferInfo GetStdHandle QueryPerformanceFrequency CreateFileW CreateThread GetFullPathNameW SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW CreateEventW GetOverlappedResult ReadFile GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessW GetFileAttributesW GetCommandLineW GetTempPathW RemoveDirectoryW DeleteFileW CopyFileExW MoveFileExW CreateSymbolicLinkW CreateHardLinkW DeviceIoControl CreateWaitableTimerExW FindNextFileW K32GetPerformanceInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetDiskFreeSpaceExW SetFileAttributesW PostQueuedCompletionStatus InitializeCriticalSectionEx ReadDirectoryChangesW CancelIo RtlCaptureContext RtlVirtualUnwind GetCurrentDirectoryW CreateMutexA GetConsoleMode GetConsoleOutputCP WriteConsoleW GetEnvironmentVariableW ReadFileEx QueryPerformanceCounter DeleteCriticalSection WriteFileEx

advapi32

RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyExW RegGetValueW RegDeleteTreeW RegSetValueExW RegCloseKey RegQueryValueExW GetUserNameW RegOpenKeyTransactedW EventUnregister EventWriteTransfer EventSetInformation EventRegister LookupAccountSidW GetTokenInformation CopySid GetLengthSid IsValidSid OpenProcessToken SystemFunction036 RevertToSelf ImpersonateAnonymousToken

comctl32

SetWindowSubclass TaskDialogIndirect DefSubclassProc RemoveWindowSubclass

ole32

CoInitializeEx RevokeDragDrop CoSetProxyBlanket RegisterDragDrop OleInitialize CoInitialize CoInitializeSecurity CoCreateInstance CoUninitialize

shlwapi

SHCreateMemStream

shell32

ShellExecuteW SHOpenFolderAndSelectItems ILFree Shell_NotifyIconW Shell_NotifyIconGetRect SHAppBarMessage DragQueryFileW DragFinish CommandLineToArgvW SHCreateItemFromParsingName ShellExecuteExW ILCreateFromPathW SHGetKnownFolderPath

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree CoTaskMemAlloc

ntdll

NtCancelIoFileEx NtCreateNamedPipeFile RtlGetVersion NtQuerySystemInformation RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtWriteFile NtReadFile NtOpenFile NtQueryInformationProcess

oleaut32

SysAllocStringLen SysAllocString SetErrorInfo GetErrorInfo SafeArrayUnaccessData SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData VariantClear SysStringLen SysFreeString

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

user32

GetKeyboardLayout MapVirtualKeyExW RegisterWindowMessageA SetParent GetKeyboardState EnableWindow GetWindowTextLengthW GetWindowTextW IsWindowVisible SetWindowTextW IsWindowEnabled GetForegroundWindow EnumDisplayMonitors InvalidateRect UpdateWindow SetCursorPos IsWindow ReleaseCapture IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos RegisterTouchWindow EnableMenuItem SetCapture AppendMenuW InsertMenuW SendInput IsIconic SetCursor LoadCursorW InvalidateRgn GetWindowLongW FlashWindowEx GetAsyncKeyState GetMenu AdjustWindowRectEx RegisterRawInputDevices SystemParametersInfoW ChangeDisplaySettingsExW SetWindowPlacement SetFocus GetKeyState ToUnicodeEx MonitorFromRect SetWindowDisplayAffinity TrackMouseEvent GetMonitorInfoW GetTouchInputInfo CloseTouchInputHandle GetWindowPlacement GetSystemMenu SetPropW DrawIconEx FindWindowExW CheckMenuItem SetWindowLongW GetClipCursor DrawTextW SetWindowRgn ReleaseDC GetSystemMetrics GetParent FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo PostQuitMessage ShowWindow SystemParametersInfoA GetActiveWindow SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu CloseClipboard RegisterClipboardFormatW OpenClipboard EmptyClipboard SetClipboardData PostMessageW GetDC GetClipboardData IsClipboardFormatAvailable TranslateAcceleratorW GetMenuItemInfoW ChangeWindowMessageFilterEx RegisterClassW ClipCursor SendMessageW FindWindowW KillTimer SetTimer EnumChildWindows DispatchMessageA GetMessageA SetWindowPos RegisterClassExW MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx DispatchMessageW TranslateMessage PeekMessageW PostThreadMessageW DestroyWindow DefWindowProcW ScreenToClient ShowCursor GetWindowLongPtrW RedrawWindow AdjustWindowRect GetMessageW SetWindowLongPtrW CreateWindowExW GetWindow MonitorFromPoint

gdi32

CreateCompatibleDC CreateDIBSection SelectObject DeleteDC GetDIBits CreateSolidBrush SetBkMode GetDeviceCaps BitBlt CombineRgn DeleteObject CreateDIBitmap CreateRectRgn SetTextColor

bcryptprimitives

ProcessPrng

secur32

LsaEnumerateLogonSessions AcquireCredentialsHandleA FreeCredentialsHandle LsaGetLogonSessionData DecryptMessage ApplyControlToken InitializeSecurityContextW LsaFreeReturnBuffer AcceptSecurityContext FreeContextBuffer EncryptMessage DeleteSecurityContext QueryContextAttributesW

ws2_32

sendto recvfrom WSASend shutdown send recv listen freeaddrinfo getaddrinfo WSACleanup WSAStartup bind setsockopt WSASocketW WSAIoctl ioctlsocket socket connect getsockopt getsockname getpeername WSAGetLastError accept closesocket

bcrypt

BCryptGenRandom

psapi

GetPerformanceInfo GetProcessMemoryInfo GetModuleFileNameExW

pdh

PdhEnumObjectsA PdhCloseQuery PdhRemoveCounter PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCollectQueryData PdhOpenQueryA

iphlpapi

GetAdaptersAddresses FreeMibTable GetIfTable2

netapi32

NetApiBufferFree NetUserGetLocalGroups NetUserEnum NetUserGetInfo

crypt32

CertVerifyCertificateChainPolicy CertOpenStore CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertDuplicateStore CertGetCertificateChain CertEnumCertificatesInStore CertDuplicateCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore

powrprof

CallNtPowerInformation

api-ms-win-crt-math-l1-1-0

sin round floorf pow trunc ceil cos ceilf truncf exp2f exp floor roundf __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s _wcsicmp wcslen strlen wcscmp

api-ms-win-crt-runtime-l1-1-0

abort _initialize_onexit_table terminate _wassert _register_onexit_function strerror _seh_filter_exe _register_thread_local_exe_atexit_callback _set_app_type _crt_atexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _c_exit _cexit

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode _callnewh malloc calloc free

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

NoRiskClient-Windows-setup.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

$TEMP/MicrosoftEdgeWebview2Setup.exe

PE Signature issue

kernel32

advapi32

ole32

shell32

user32

generic

noriskclient-launcher-v3.exe

kernel32

advapi32

comctl32

ole32

shlwapi

shell32

combase

ntdll

oleaut32

api-ms-win-core-synch-l1-2-0

dwmapi

user32

gdi32

bcryptprimitives

secur32

ws2_32

bcrypt

psapi

pdh

iphlpapi

netapi32

crypt32

powrprof

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0