NoRiskClient-Windows-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NoRiskClient-Windows-setup.exe
Size 19.0MB
Sample260910-x4py6aed58
SHA256 5693a35c64b7b5e223e78e0d9d7684b883d5a81de19dd77a0bf289d551d4ad1e
MD5 ef5eca790d815ea6b9c54c1440ef085d
SHA1 ab503972d4490852d2314579d8d10a486fc252e2
SHA512 0d6da22ebddf809a5edf8e949a1250043b68c4476d9c0b0552267056ebdbdf5f18a6cbe992af54e7fc17455ee37c8ecd4cbf840c465c3c783bcd49e9d875529f
SSDEEP 393216:i20xq4uMk4TveRCmFXZSth2+HYfLBVjZsFR1G1lwDjFg0L81KrBN7a957wfSqxO:i20xqWnTBmpZSLpHYfF9OnG1WDLLhrBu
TLSH
T1131733B7DC77A206F70621316663CC2B0700F36285E853A1267D46C17E2A6BBF76D939
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll

File Explorer

NoRiskClient-Windows-setup.exe

.exe 19.0MB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 30KB
$TEMP/MicrosoftEdgeWebview2Setup.exe

.exe 1.7MB
noriskclient-launcher-v3.exe

.exe 31.9MB
uninstall.exe.nsis

24KB

NoRiskClient-Windows-setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 5693a35c64b7b5e223e78e0d9d7684b883d5a81de19dd77a0bf289d551d4ad1e
MD5 ef5eca790d815ea6b9c54c1440ef085d
SHA1 ab503972d4490852d2314579d8d10a486fc252e2
SHA512 0d6da22ebddf809a5edf8e949a1250043b68c4476d9c0b0552267056ebdbdf5f18a6cbe992af54e7fc17455ee37c8ecd4cbf840c465c3c783bcd49e9d875529f
SSDEEP 393216:i20xq4uMk4TveRCmFXZSth2+HYfLBVjZsFR1G1lwDjFg0L81KrBN7a957wfSqxO:i20xqWnTBmpZSLpHYfF9OnG1WDLLhrBu
TLSH
T1131733B7DC77A206F70621316663CC2B0700F36285E853A1267D46C17E2A6BBF76D939
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

e6:2b:ce:6e:6d:fe:3c:fb:66:0d:1d:f3:9e:e9:ad:17:e8:a5:18:c3:0c:94:f4:7a:95:2f:77:ad:c4:7d:22:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

Chains

Sep 10, 2026

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

Serial Number

33:00:05:d3:84:26:89:10:c1:b3:4b:58:6a:00:00:00:05:d3:84

Issuer

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 9, 2026 - Sep 12, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:17:27:45:09:0b:8b:87:af:c6:00:00:00:00:00:17

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:56:7e:8f:9d:58:08:8e:e9:60:00:00:00:00:00:56

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/StartMenu.dll

IMPHASH 80469f6834e579db68a646d49780b9d5
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH e6c3208e90c430388b2da3b455c174ba
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

$TEMP/MicrosoftEdgeWebview2Setup.exe

IMPHASH 7899cb8ba886a0690bdc28d8b481bbd1
SHA256 17debf797a6c737959bc588236e897936ffac1af5f7e515e674ab32f9edfe719
MD5 8ee098f5969d3395c0ed113bc91f36b3
SHA1 8f6eda8bfeea599d3f0a2d818ad57defeba17a4e
SHA512 5ff8fb0b9c12e8e605601aa34e43f31af17473a037e95934888c6054c426bbc0e804d9068c3e3582cb0b02f1aa4cb293f108a96d6b0562c70a0402bda6c3b9fe
SSDEEP 49152:xiGu3I5VuJhf/tw0rMc0wBTlcjT7p3z+I6BurP:xi45cr9wm87p3Sor
TLSH
T15685220876E04031F1F32E315AF089B16A7DBC658F765ADF63815E285E38AC2E235767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

PE Signature issue

Digest

8d:36:f6:80:ed:ad:15:bf:73:94:54:cf:aa:d8:08:70:ab:b4:b0:22:67:46:db:6f:2e:36:85:31:a4:3c:8d:c5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Chains

Sep 10, 2026

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Digest

8d:36:f6:80:ed:ad:15:bf:73:94:54:cf:aa:d8:08:70:ab:b4:b0:22:67:46:db:6f:2e:36:85:31:a4:3c:8d:c5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 28, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Serial Number

64:57:97:41:81:d1:09:95:4f:1c:10:95:8c:65:4e:63

Issuer

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 15, 2020 - Dec 31, 2039

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

33792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType RaiseException LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW DecodePointer VirtualProtect EncodePointer LoadLibraryExW QueryPerformanceCounter GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStringTypeW CreateDirectoryW SizeofResource FindFirstFileW Wow64DisableWow64FsRedirection RemoveDirectoryW GetTempPathW FormatMessageW Wow64RevertWow64FsRedirection GetFileAttributesExW GetDiskFreeSpaceExW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW CreateMutexW WaitForSingleObject ReleaseMutex CreateEventW SetEvent CreateThread UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery CreateProcessW GetExitCodeProcess ResetEvent WaitForSingleObjectEx GetSystemInfo LoadLibraryExA

advapi32

RegSetValueExA SetSecurityDescriptorDacl GetAclInformation SetSecurityDescriptorOwner GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD SetSecurityDescriptorGroup RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExW RegOpenKeyExA RegDeleteValueA

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shell32

SHGetKnownFolderPath ord680 CommandLineToArgvW SHGetFolderPathW

user32

CharLowerBuffW MessageBoxW

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

noriskclient-launcher-v3.exe

IMPHASH e3a46b7f887c1b9c5262ae6913e1e559
SHA256 486d8c28dd39da3a2cdc1de072fe4ca699452d85c3637ce70b92d3027bca71c0
MD5 bdcdf4ece0d3cdfe0cbd767b0758188f
SHA1 32bb4e4480211f46da24fd9451f4a440abe24904
SHA512 60546189314b2b8c5e1977217367f2fc56a4f10faa3005937c070bd18a567bad7b9970bcad004f9945dbd35efee7939f3b9c0b0bd0a6840c62d6857006a4eaed
SSDEEP 393216:RcANfB5U+NCBcW3z6j/MOXu0BObpvDrxxdnj9gZfX:G4p59CeW3z6jXXu0BOdpxgFX
TLSH
T15877AD03F69180E4D0AEC478835AE637EB72BC894535B25B5BE4BB112F79F50AB0D319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

c0:d5:70:4e:ae:68:5a:d1:09:63:fe:a9:62:d1:da:bc:b6:ae:2f:0b:05:1e:fe:25:cf:d2:d5:b2:93:63:d9:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

Chains

Sep 10, 2026

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

Serial Number

33:00:05:d3:84:26:89:10:c1:b3:4b:58:6a:00:00:00:05:d3:84

Issuer

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 9, 2026 - Sep 12, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:17:27:45:09:0b:8b:87:af:c6:00:00:00:00:00:17

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:65:cd:eb:3f:a1:d7:fc:d2:00:00:00:00:00:58

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

16839600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

noriskclient_launcher_v3.pdb

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegDeleteTreeW RegOpenKeyExW RegOpenKeyTransactedW RegCreateKeyExW GetUserNameW RegGetValueW RegCreateKeyTransactedW ImpersonateAnonymousToken SystemFunction036 OpenProcessToken IsValidSid GetLengthSid CopySid GetTokenInformation LookupAccountSidW EventRegister EventSetInformation EventWriteTransfer EventUnregister RevertToSelf

kernel32

FlsAlloc WaitForSingleObject GetModuleHandleExW WakeAllConditionVariable SleepConditionVariableSRW FlsFree TerminateProcess GetProcessId UnregisterWaitEx RtlPcToFileHeader LoadLibraryExA FlsGetValue EncodePointer FlsSetValue IsThreadAFiber AcquireSRWLockExclusive RtlLookupFunctionEntry GetTickCount FormatMessageA GetSystemTime GetSystemTimeAsFileTime HeapDestroy HeapCompact FlushViewOfFile OutputDebugStringW HeapSize HeapValidate OutputDebugStringA HeapFree RaiseException LoadLibraryExW SleepEx CloseHandle ExitProcess GetModuleHandleA GetSystemDirectoryW ReleaseSemaphore GetWindowsDirectoryW GetTimeZoneInformationForYear SystemTimeToFileTime HeapAlloc GetModuleFileNameW OpenProcess ReleaseSRWLockExclusive WaitForMultipleObjects GetProcessHeap QueryFullProcessImageNameW GetExitCodeProcess GetLastError RegisterWaitForSingleObject MultiByteToWideChar GlobalFree LoadLibraryW GetSystemInfo UnmapViewOfFile GetCurrentProcess MapViewOfFile GlobalMemoryStatusEx GetTickCount64 GetLogicalProcessorInformationEx GetComputerNameExW VirtualProtect FormatMessageW Sleep SetWaitableTimer lstrlenW GlobalAlloc GetProcessTimes WideCharToMultiByte DuplicateHandle SetLastError HeapReAlloc GetCurrentThread SetThreadStackGuarantee GetSystemTimePreciseAsFileTime GetCurrentProcessId SwitchToThread GetUserDefaultUILanguage LoadLibraryA LCIDToLocaleName SetHandleInformation CompareStringOrdinal LocalFree HeapCreate GetModuleHandleW GetProcAddress FreeLibrary GetSystemTimes GetProcessIoCounters ReleaseMutex ReadProcessMemory GlobalUnlock GlobalLock VirtualQueryEx WaitForSingleObjectEx GetCurrentThreadId GlobalSize GetFinalPathNameByHandleW GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort SetFileCompletionNotificationModes ReadFile InitializeSListHead WriteFile CancelIoEx GetStdHandle GetConsoleScreenBufferInfo FindFirstVolumeW FindNextVolumeW CreateFileMappingW SetUnhandledExceptionFilter RtlUnwindEx GetLogicalDrives SetConsoleTextAttribute LockFileEx FindClose SetFileTime AddVectoredExceptionHandler CreateMutexW GetOverlappedResult InitializeCriticalSectionEx FindVolumeClose DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AreFileApisANSI GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW CreateFileA DeleteFileA UnlockFile GetFileSize Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetPerformanceInfo GetDiskFreeSpaceExW FindNextFileW SetFilePointerEx CreateWaitableTimerExW DeviceIoControl CreateHardLinkW CreateSymbolicLinkW CopyFileExW DeleteFileW RemoveDirectoryW GetTempPathW GetCommandLineW GetFileAttributesW CreateProcessW FreeEnvironmentStringsW GetEnvironmentStringsW CreateEventW CreateDirectoryW FlushFileBuffers GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW SetFileInformationByHandle GetFullPathNameW CreateThread QueryPerformanceCounter QueryPerformanceFrequency WriteFileEx ReadFileEx GetEnvironmentVariableW WriteConsoleW GetConsoleOutputCP GetConsoleMode CreateMutexA GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext CancelIo ReadDirectoryChangesW CreateFileW MoveFileExW SetFileAttributesW CreateSemaphoreW GetVolumeInformationW GetDriveTypeW GetVolumePathNamesForVolumeNameW SetEnvironmentVariableW

comctl32

RemoveWindowSubclass SetWindowSubclass DefSubclassProc TaskDialogIndirect

shell32

Shell_NotifyIconW ILCreateFromPathW ILFree SHCreateItemFromParsingName ShellExecuteW CommandLineToArgvW DragFinish DragQueryFileW SHAppBarMessage Shell_NotifyIconGetRect ShellExecuteExW SHOpenFolderAndSelectItems SHGetKnownFolderPath

combase

CoTaskMemFree CoTaskMemAlloc CoCreateFreeThreadedMarshaler

ole32

RegisterDragDrop CoInitializeSecurity CoInitializeEx OleInitialize RevokeDragDrop CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket

ntdll

NtOpenFile NtQuerySystemInformation NtWriteFile RtlGetVersion NtQueryInformationProcess NtCancelIoFileEx NtDeviceIoControlFile NtCreateNamedPipeFile NtReadFile NtCreateFile RtlNtStatusToDosError

shlwapi

SHCreateMemStream

oleaut32

GetErrorInfo SafeArrayUnaccessData VariantClear SetErrorInfo SafeArrayAccessData SafeArrayGetUBound SysStringLen SafeArrayGetLBound SysAllocStringLen SysFreeString SysAllocString

user32

SetMenuItemInfoW ReleaseDC SetFocus GetWindow AppendMenuW InsertMenuW CreateAcceleratorTableW GetMessageW TranslateMessage DispatchMessageW DestroyWindow SetWindowLongPtrW DefWindowProcW DestroyAcceleratorTable DestroyIcon SetTimer KillTimer GetDC GetParent SetWindowRgn FindWindowExW DestroyMenu CloseClipboard CreateMenu GetTouchInputInfo ScreenToClient TrackMouseEvent SystemParametersInfoW FlashWindowEx LoadCursorW RegisterClipboardFormatW IsIconic PostThreadMessageW RegisterTouchWindow PeekMessageW IsWindow SetCursorPos MsgWaitForMultipleObjectsEx GetRawInputData UpdateWindow InvalidateRect SetClipboardData RedrawWindow EmptyClipboard SetWindowPos OpenClipboard GetWindowLongPtrW ChangeWindowMessageFilterEx CloseTouchInputHandle DrawIconEx ValidateRect IsWindowEnabled SetWindowTextW EnableWindow SetParent SetPropW MonitorFromRect SetCapture EnumDisplayMonitors MonitorFromPoint TranslateAcceleratorW RegisterClassW ShowCursor GetUpdateRect ClipCursor GetMenuItemInfoW MapVirtualKeyW GetSystemMetrics GetClipCursor RegisterRawInputDevices SetWindowDisplayAffinity ReleaseCapture GetKeyState ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyboardState GetWindowPlacement GetMonitorInfoW SetWindowPlacement ChangeDisplaySettingsExW AdjustWindowRectEx GetMenu GetWindowLongW SetWindowLongW GetSystemMenu InvalidateRgn RegisterWindowMessageA CreateWindowExW FindWindowW GetWindowTextLengthW GetAsyncKeyState UnhookWindowsHookEx SetWindowsHookExW CallNextHookEx GetWindowTextW EnumWindows GetWindowThreadProcessId GetClassNameW IsWindowVisible GetForegroundWindow SendMessageW SetCursor IsClipboardFormatAvailable GetClipboardData EnumChildWindows DispatchMessageA GetMessageA AdjustWindowRect IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo PostQuitMessage ShowWindow SystemParametersInfoA PostMessageW GetActiveWindow SetMenu CreateIcon RemoveMenu CheckMenuItem DrawMenuBar EnableMenuItem RegisterClassExW CreatePopupMenu

gdi32

GetDIBits CreateSolidBrush SetBkMode SetTextColor DeleteObject GetDeviceCaps CreateCompatibleDC CreateRectRgn CreateDIBSection SelectObject BitBlt CreateDIBitmap DeleteDC CombineRgn

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

bcryptprimitives

ProcessPrng

secur32

LsaGetLogonSessionData AcquireCredentialsHandleA LsaFreeReturnBuffer DeleteSecurityContext EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken DecryptMessage LsaEnumerateLogonSessions QueryContextAttributesW FreeCredentialsHandle

ws2_32

recvfrom WSASend shutdown send recv listen freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt sendto WSASocketW accept WSAIoctl connect getsockopt ioctlsocket socket getsockname WSAGetLastError getpeername closesocket bind

bcrypt

BCryptGenRandom

psapi

GetProcessMemoryInfo GetModuleFileNameExW GetPerformanceInfo

pdh

PdhOpenQueryA PdhCollectQueryData PdhEnumObjectsA PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhRemoveCounter PdhCloseQuery

iphlpapi

GetAdaptersAddresses FreeMibTable GetIfTable2

netapi32

NetUserGetInfo NetApiBufferFree NetUserEnum NetUserGetLocalGroups

crypt32

CertDuplicateCertificateChain CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertEnumCertificatesInStore CertDuplicateCertificateContext CertAddCertificateContextToStore CertFreeCertificateContext CertDuplicateStore

powrprof

CallNtPowerInformation

api-ms-win-crt-string-l1-1-0

wcslen wcscmp strspn _wcsicmp strcmp strcpy_s strlen strncmp strcspn

api-ms-win-crt-math-l1-1-0

fabs ceil trunc log floor roundf cos ceilf _dclass sin __setusermatherr floorf exp exp2f truncf pow round

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit strerror _exit __p___argc _endthreadex _beginthreadex __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table abort _register_onexit_function _crt_atexit terminate _wassert

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free calloc _msize realloc malloc

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

NoRiskClient-Windows-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

$TEMP/MicrosoftEdgeWebview2Setup.exe

PE Signature issue

kernel32

advapi32

ole32

shell32

user32

generic

noriskclient-launcher-v3.exe

advapi32

kernel32

comctl32

shell32

combase

ole32

ntdll

shlwapi

oleaut32

user32

gdi32

api-ms-win-core-synch-l1-2-0

dwmapi

bcryptprimitives

secur32

ws2_32

bcrypt

psapi

pdh

iphlpapi

netapi32

crypt32

powrprof

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0