NoRiskClient-Windows-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NoRiskClient-Windows-setup.exe
Size 19.1MB
Sample261001-qvhp6ayaka
SHA256 27486b7d87f4ac8ea112a406ec3a740a76493d6ba33e445b16f858d0a1c252ad
MD5 ca9d91752582dcd758d2c609d2034cc8
SHA1 db29e9c1664f7eaaa5996cfa14eac1893617730c
SHA512 21c4999ebd87dda0881be5c5c0d065dafb3d0e2eed193ccb71142d75924aea718a97209b4891801de2009bd554aeec8fac37ea1ecf842f1bf2845068dac9223c
SSDEEP 393216:QjTla9KsDexeOuukexBFEx8u0j7m7CxioHpNSMYywfNe4rMtJADBMa/:QFKKRkexixCxiS4ywfNzMUDf
TLSH
T1E317339607789A96C5C1767C6F382EA477FC85CD2BB93D464B6C2A884B50D70DCACCC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll

File Explorer

NoRiskClient-Windows-setup.exe

.exe 19.1MB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 30KB
$TEMP/MicrosoftEdgeWebview2Setup.exe

.exe 1.8MB
noriskclient-launcher-v3.exe

.exe 31.9MB
uninstall.exe.nsis

24KB

NoRiskClient-Windows-setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 27486b7d87f4ac8ea112a406ec3a740a76493d6ba33e445b16f858d0a1c252ad
MD5 ca9d91752582dcd758d2c609d2034cc8
SHA1 db29e9c1664f7eaaa5996cfa14eac1893617730c
SHA512 21c4999ebd87dda0881be5c5c0d065dafb3d0e2eed193ccb71142d75924aea718a97209b4891801de2009bd554aeec8fac37ea1ecf842f1bf2845068dac9223c
SSDEEP 393216:QjTla9KsDexeOuukexBFEx8u0j7m7CxioHpNSMYywfNe4rMtJADBMa/:QFKKRkexixCxiS4ywfNzMUDf
TLSH
T1E317339607789A96C5C1767C6F382EA477FC85CD2BB93D464B6C2A884B50D70DCACCC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

af:83:e6:46:6f:5f:98:40:16:4c:ab:ba:0f:75:40:44:6a:45:c7:42:d5:45:ff:ac:72:99:71:ba:5b:7d:9d:6d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

Chains

Sep 16, 2026

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

Serial Number

33:00:06:28:bc:1d:5b:33:45:20:30:9f:38:00:00:00:06:28:bc

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 14, 2026 - Sep 17, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:65:cd:eb:3f:a1:d7:fc:d2:00:00:00:00:00:58

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/StartMenu.dll

IMPHASH 80469f6834e579db68a646d49780b9d5
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH e6c3208e90c430388b2da3b455c174ba
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

$TEMP/MicrosoftEdgeWebview2Setup.exe

IMPHASH 7899cb8ba886a0690bdc28d8b481bbd1
SHA256 83004a28553bcf2f932bf03564fbab407b8e1f59cd265f8dc99cc53d028e459c
MD5 7310a0f48396b5a5a64672e50cd71558
SHA1 1ab49e44f257b5bf663fc4d5f659fe0717fd6eeb
SHA512 1ba083e40bc0ff4316ce91af70f9b5b4aeb8227635483dcf37bc7dfaffcf0780617e89834c08f0b5de87110cf0369257a760d1d261e6ed311d9bea41af9ab239
SSDEEP 49152:SiGh3YjufiUIQ+W2P3pGBoVkpdgWI80zYiHqYAh0amwXo:Sif6fiUeT3uoVkpdglC6qGbco
TLSH
T1C78522007AE58032F1B72931A5F4DAB41E7EFC716B7A98DF17840A582E309E1D639367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

PE Signature issue

Digest

1b:c7:3d:3e:89:7b:ec:df:76:09:6f:4d:19:b7:e9:41:03:c5:2e:6c:e7:f5:a5:4f:e8:0c:b6:8e:73:25:14:a4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Chains

Sep 25, 2026

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Digest

1b:c7:3d:3e:89:7b:ec:df:76:09:6f:4d:19:b7:e9:41:03:c5:2e:6c:e7:f5:a5:4f:e8:0c:b6:8e:73:25:14:a4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 10, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Serial Number

64:57:97:41:81:d1:09:95:4f:1c:10:95:8c:65:4e:63

Issuer

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 15, 2020 - Dec 31, 2039

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

33792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType RaiseException LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW DecodePointer VirtualProtect EncodePointer LoadLibraryExW QueryPerformanceCounter GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStringTypeW CreateDirectoryW SizeofResource FindFirstFileW Wow64DisableWow64FsRedirection RemoveDirectoryW GetTempPathW FormatMessageW Wow64RevertWow64FsRedirection GetFileAttributesExW GetDiskFreeSpaceExW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW CreateMutexW WaitForSingleObject ReleaseMutex CreateEventW SetEvent CreateThread UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery CreateProcessW GetExitCodeProcess ResetEvent WaitForSingleObjectEx GetSystemInfo LoadLibraryExA

advapi32

RegSetValueExA SetSecurityDescriptorDacl GetAclInformation SetSecurityDescriptorOwner GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD SetSecurityDescriptorGroup RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExW RegOpenKeyExA RegDeleteValueA

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shell32

SHGetKnownFolderPath ord680 CommandLineToArgvW SHGetFolderPathW

user32

CharLowerBuffW MessageBoxW

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

noriskclient-launcher-v3.exe

IMPHASH 8d70f39be8f8cd1fa900073fe6c988a4
SHA256 ec8151ce047efb8ca8cd059314574b76a1d601de820e43ff0aea471f32055939
MD5 9293eb809dd4cb7ac2e97e603965668c
SHA1 4326ef87926c5a1e3860dcd37bbe138ae30941a6
SHA512 342c1565002956ef6e49b86932544449fa5df666080cf4242dd72d584989507f723cd4bf86d12f75ccd402d785e8c7144bf0f6f67f71213b1977dc5b8faf5509
SSDEEP 393216:6OT+83c/ixyBcW3z6j/MOXidvJYFBObpvDrnnj2gaSjTO:BTZ3c/heW3z6jXXidCFBOdpLTO
TLSH
T147779D07F29180E4D0AEC478835AE637EB72BC894525B25F5BE4BB112F79F50AB0D319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

2e:68:ce:a3:99:eb:38:da:e8:76:14:d5:c4:a0:23:bb:fd:37:f1:69:25:1e:b4:36:76:77:18:8a:2f:34:72:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

Chains

Sep 16, 2026

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

Serial Number

33:00:06:28:bc:1d:5b:33:45:20:30:9f:38:00:00:00:06:28:bc

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 14, 2026 - Sep 17, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:24:d3:95:e0:a2:e9:c9:31:00:00:00:00:00:57

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

16846064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

noriskclient_launcher_v3.pdb

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegDeleteTreeW RegOpenKeyExW RegOpenKeyTransactedW RegCreateKeyExW GetUserNameW RegGetValueW RegCreateKeyTransactedW ImpersonateAnonymousToken SystemFunction036 OpenProcessToken IsValidSid GetLengthSid CopySid GetTokenInformation LookupAccountSidW EventRegister EventSetInformation EventWriteTransfer EventUnregister RevertToSelf

kernel32

FlsAlloc WaitForSingleObject GetModuleHandleExW WakeAllConditionVariable SleepConditionVariableSRW FlsFree TerminateProcess GetProcessId UnregisterWaitEx RtlPcToFileHeader LoadLibraryExA FlsGetValue EncodePointer FlsSetValue IsThreadAFiber AcquireSRWLockExclusive RtlLookupFunctionEntry GetTickCount FormatMessageA GetSystemTime GetSystemTimeAsFileTime HeapDestroy HeapCompact FlushViewOfFile OutputDebugStringW HeapSize HeapValidate OutputDebugStringA HeapFree RaiseException LoadLibraryExW SleepEx CloseHandle ExitProcess GetModuleHandleA GetSystemDirectoryW ReleaseSemaphore GetWindowsDirectoryW GetTimeZoneInformationForYear SystemTimeToFileTime HeapAlloc GetModuleFileNameW OpenProcess ReleaseSRWLockExclusive WaitForMultipleObjects GetProcessHeap QueryFullProcessImageNameW GetExitCodeProcess GetLastError RegisterWaitForSingleObject MultiByteToWideChar GlobalFree LoadLibraryW GetSystemInfo UnmapViewOfFile GetCurrentProcess MapViewOfFile GlobalMemoryStatusEx GetTickCount64 GetLogicalProcessorInformationEx GetComputerNameExW VirtualProtect FormatMessageW Sleep SetWaitableTimer lstrlenW GlobalAlloc GetProcessTimes WideCharToMultiByte DuplicateHandle SetLastError HeapReAlloc GetCurrentThread SetThreadStackGuarantee GetSystemTimePreciseAsFileTime GetCurrentProcessId SwitchToThread LoadLibraryA GetUserDefaultUILanguage LCIDToLocaleName SetHandleInformation CompareStringOrdinal LocalFree HeapCreate GetModuleHandleW GetProcAddress FreeLibrary GetSystemTimes GetProcessIoCounters ReleaseMutex ReadProcessMemory GlobalUnlock GlobalLock VirtualQueryEx WaitForSingleObjectEx GetCurrentThreadId GlobalSize GetFinalPathNameByHandleW GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort SetFileCompletionNotificationModes ReadFile InitializeSListHead WriteFile CancelIoEx GetStdHandle GetConsoleScreenBufferInfo FindFirstVolumeW FindNextVolumeW CreateFileMappingW SetUnhandledExceptionFilter RtlUnwindEx GetLogicalDrives SetConsoleTextAttribute LockFileEx SetFileTime AddVectoredExceptionHandler CreateMutexW SetEnvironmentVariableW GetOverlappedResult InitializeCriticalSectionEx FindVolumeClose DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AreFileApisANSI GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW CreateFileA DeleteFileA UnlockFile GetFileSize Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetPerformanceInfo GetDiskFreeSpaceExW FindNextFileW SetFilePointerEx CreateWaitableTimerExW DeviceIoControl CreateHardLinkW CreateSymbolicLinkW CopyFileExW DeleteFileW RemoveDirectoryW GetTempPathW GetCommandLineW GetFileAttributesW CreateProcessW FreeEnvironmentStringsW GetEnvironmentStringsW CreateEventW CreateDirectoryW FlushFileBuffers GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW SetFileInformationByHandle GetFullPathNameW CreateThread QueryPerformanceCounter QueryPerformanceFrequency WriteFileEx ReadFileEx GetEnvironmentVariableW WriteConsoleW GetConsoleOutputCP GetConsoleMode CreateMutexA GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext CancelIo ReadDirectoryChangesW CreateFileW MoveFileExW SetFileAttributesW CreateSemaphoreW GetVolumeInformationW GetDriveTypeW GetVolumePathNamesForVolumeNameW FindClose

comctl32

DefSubclassProc SetWindowSubclass RemoveWindowSubclass TaskDialogIndirect

shell32

Shell_NotifyIconW ILCreateFromPathW ILFree SHCreateItemFromParsingName ShellExecuteW CommandLineToArgvW DragFinish DragQueryFileW SHAppBarMessage Shell_NotifyIconGetRect ShellExecuteExW SHOpenFolderAndSelectItems SHGetKnownFolderPath

combase

CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemFree

ole32

RegisterDragDrop CoInitializeSecurity CoInitializeEx OleInitialize RevokeDragDrop CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket

ntdll

NtOpenFile NtQuerySystemInformation NtWriteFile RtlGetVersion NtQueryInformationProcess NtCancelIoFileEx NtDeviceIoControlFile NtCreateNamedPipeFile NtReadFile NtCreateFile RtlNtStatusToDosError

shlwapi

SHCreateMemStream

oleaut32

GetErrorInfo SafeArrayUnaccessData VariantClear SetErrorInfo SafeArrayAccessData SafeArrayGetUBound SysStringLen SafeArrayGetLBound SysAllocStringLen SysFreeString SysAllocString

user32

SetMenuItemInfoW ReleaseDC SetFocus GetWindow AppendMenuW InsertMenuW CreateAcceleratorTableW GetMessageW TranslateMessage DispatchMessageW SetWindowLongPtrW DefWindowProcW DestroyWindow DestroyAcceleratorTable DestroyIcon SetTimer KillTimer GetDC GetParent SetWindowRgn FindWindowExW DestroyMenu CloseClipboard CreateMenu GetTouchInputInfo ScreenToClient TrackMouseEvent SystemParametersInfoW FlashWindowEx LoadCursorW RegisterClipboardFormatW IsIconic PostThreadMessageW RegisterTouchWindow PeekMessageW IsWindow SetCursorPos MsgWaitForMultipleObjectsEx GetRawInputData UpdateWindow InvalidateRect SetClipboardData RedrawWindow EmptyClipboard SetWindowPos OpenClipboard GetWindowLongPtrW ChangeWindowMessageFilterEx CloseTouchInputHandle DrawIconEx ValidateRect IsWindowEnabled SetWindowTextW EnableWindow SetParent SetPropW MonitorFromRect SetCapture EnumDisplayMonitors MonitorFromPoint TranslateAcceleratorW RegisterClassW ShowCursor GetUpdateRect ClipCursor GetMenuItemInfoW MapVirtualKeyW GetSystemMetrics GetClipCursor RegisterRawInputDevices SetWindowDisplayAffinity ReleaseCapture GetKeyState ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyboardState GetWindowPlacement GetMonitorInfoW SetWindowPlacement ChangeDisplaySettingsExW AdjustWindowRectEx GetMenu GetWindowLongW SetWindowLongW GetSystemMenu InvalidateRgn RegisterWindowMessageA CreateWindowExW FindWindowW GetWindowTextLengthW GetAsyncKeyState UnhookWindowsHookEx SetWindowsHookExW CallNextHookEx GetWindowTextW EnumWindows GetWindowThreadProcessId GetClassNameW IsWindowVisible GetForegroundWindow SendMessageW SetCursor IsClipboardFormatAvailable GetClipboardData EnumChildWindows DispatchMessageA GetMessageA AdjustWindowRect IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo PostQuitMessage ShowWindow SystemParametersInfoA PostMessageW GetActiveWindow SetMenu CreateIcon RemoveMenu CheckMenuItem DrawMenuBar EnableMenuItem RegisterClassExW CreatePopupMenu

gdi32

GetDIBits CreateSolidBrush SetBkMode SetTextColor DeleteObject GetDeviceCaps CreateCompatibleDC CreateRectRgn CreateDIBSection SelectObject BitBlt CreateDIBitmap DeleteDC CombineRgn

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

bcryptprimitives

ProcessPrng

secur32

LsaGetLogonSessionData AcquireCredentialsHandleA LsaFreeReturnBuffer DeleteSecurityContext EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken DecryptMessage LsaEnumerateLogonSessions QueryContextAttributesW FreeCredentialsHandle

ws2_32

recvfrom WSASend shutdown send recv listen freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt sendto WSASocketW accept WSAIoctl connect getsockopt ioctlsocket socket getsockname WSAGetLastError getpeername closesocket bind

bcrypt

BCryptGenRandom

psapi

GetProcessMemoryInfo GetModuleFileNameExW GetPerformanceInfo

pdh

PdhOpenQueryA PdhCollectQueryData PdhEnumObjectsA PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhRemoveCounter PdhCloseQuery

iphlpapi

GetAdaptersAddresses FreeMibTable GetIfTable2

netapi32

NetUserGetInfo NetApiBufferFree NetUserEnum NetUserGetLocalGroups

crypt32

CertEnumCertificatesInStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertOpenStore CertFreeCertificateChain CertGetCertificateChain CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertCloseStore CertFreeCertificateContext CertDuplicateStore

powrprof

CallNtPowerInformation

api-ms-win-crt-string-l1-1-0

wcslen wcscmp strspn _wcsicmp strcmp strcpy_s strlen strncmp strcspn

api-ms-win-crt-math-l1-1-0

fabs ceil trunc sin log roundf cos ceilf _dclass floorf __setusermatherr floor exp exp2f pow round truncf

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit strerror _exit __p___argc _endthreadex _beginthreadex __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table abort _register_onexit_function _crt_atexit terminate _wassert

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free calloc _msize realloc malloc

api-ms-win-crt-utility-l1-1-0

_rotl64 qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

NoRiskClient-Windows-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

$TEMP/MicrosoftEdgeWebview2Setup.exe

PE Signature issue

kernel32

advapi32

ole32

shell32

user32

generic

noriskclient-launcher-v3.exe

advapi32

kernel32

comctl32

shell32

combase

ole32

ntdll

shlwapi

oleaut32

user32

gdi32

api-ms-win-core-synch-l1-2-0

dwmapi

bcryptprimitives

secur32

ws2_32

bcrypt

psapi

pdh

iphlpapi

netapi32

crypt32

powrprof

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0