NoRiskClient-Windows-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NoRiskClient-Windows-setup.exe
Size 18.0MB
Sample261004-2qlrssszd1
SHA256 2b24ef661fcdaa05377251e7a4753c2f3fc3c3c5309f1a9b33db8a831fcb667d
MD5 ddbca2b88cfd784433b58c06f4902f34
SHA1 937e09542987d24722bab4b8953bbdef32bc5f48
SHA512 6e73a938e9996f856b1abdffc137cc1c9ef1741f0617a84a6688a2c944bb6cb38a5370346f58ba1aca8f0cb90115cbdecc9065b0f04ad0a627f37740a286427c
SSDEEP 393216:EpjQytiCK8vTnumraEHPfVhzIGWDYh+nzq5M2RVVLpUrl+:EWMPRrjvM6Qzq22lpA+
TLSH
T16F173390D31E5C1FE1BFD4F311B98902AC9A39600DA857847B74CF3835693A5BA8D71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/noriskclient-launcher-v3.exe

File Explorer

NoRiskClient-Windows-setup.exe

.exe 18.0MB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 30KB
$TEMP/MicrosoftEdgeWebview2Setup.exe

.exe 1.7MB
noriskclient-launcher-v3.exe

.exe 29.5MB
uninstall.exe.nsis

24KB

NoRiskClient-Windows-setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 2b24ef661fcdaa05377251e7a4753c2f3fc3c3c5309f1a9b33db8a831fcb667d
MD5 ddbca2b88cfd784433b58c06f4902f34
SHA1 937e09542987d24722bab4b8953bbdef32bc5f48
SHA512 6e73a938e9996f856b1abdffc137cc1c9ef1741f0617a84a6688a2c944bb6cb38a5370346f58ba1aca8f0cb90115cbdecc9065b0f04ad0a627f37740a286427c
SSDEEP 393216:EpjQytiCK8vTnumraEHPfVhzIGWDYh+nzq5M2RVVLpUrl+:EWMPRrjvM6Qzq22lpA+
TLSH
T16F173390D31E5C1FE1BFD4F311B98902AC9A39600DA857847B74CF3835693A5BA8D71B
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

32:22:af:2b:09:e7:6b:a6:b8:06:22:fa:87:4b:91:81:38:64:6f:10:1b:e6:fa:9d:d4:b6:0d:72:0c:92:d0:1a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

Chains

Aug 16, 2026

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Palior UG (haftungsbeschränkt),O=Palior UG (haftungsbeschränkt),L=Karlsruhe,ST=Baden-Württemberg,C=DE

Serial Number

33:00:04:cc:84:f9:99:3a:ac:86:bb:dc:3b:00:00:00:04:cc:84

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 14, 2026 - Aug 17, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:55:d9:dd:69:26:28:f9:f8:e2:00:00:00:00:00:55

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/StartMenu.dll

IMPHASH 80469f6834e579db68a646d49780b9d5
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH e6c3208e90c430388b2da3b455c174ba
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

$TEMP/MicrosoftEdgeWebview2Setup.exe

IMPHASH 7899cb8ba886a0690bdc28d8b481bbd1
SHA256 be695eb3732a94e181f008ab5cf6ee650f8644676e87f9e02b6ab0d02f2ea08e
MD5 ec85be242f7016c1d8d917660481ed78
SHA1 61838956cb8257ddb9d95247e68e9517e7f787b9
SHA512 e966afb44fd2c38a590525ec73970a4bf3ee9f9aca4fd52feed33e8c33ab2a78d898c15cd5a69de3f5327a3fddfce73907ad81515b0de3e976a1373eedf85523
SSDEEP 49152:ZPiGk3dYVwnRn0k+xxW+YwPr+cmcIW2TfqYLsP1URN:diPR0k+xx6wycmTl/gCRN
TLSH
T1D5852200B6E48072F2B31E316EF481B21A7DFD725B3599CB23541A6D1A34AD1EA353A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

PE Signature issue

Digest

d5:a8:62:f9:b3:64:74:16:29:5c:fb:c4:32:d6:61:f1:71:eb:c3:3c:93:a1:9f:e5:1a:1c:42:53:0b:99:26:38

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Chains

Oct 2, 2026

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Digest

d5:a8:62:f9:b3:64:74:16:29:5c:fb:c4:32:d6:61:f1:71:eb:c3:3c:93:a1:9f:e5:1a:1c:42:53:0b:99:26:38

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 14, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Serial Number

64:57:97:41:81:d1:09:95:4f:1c:10:95:8c:65:4e:63

Issuer

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 15, 2020 - Dec 31, 2039

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

33792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType RaiseException LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW DecodePointer VirtualProtect EncodePointer LoadLibraryExW QueryPerformanceCounter GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStringTypeW CreateDirectoryW SizeofResource FindFirstFileW Wow64DisableWow64FsRedirection RemoveDirectoryW GetTempPathW FormatMessageW Wow64RevertWow64FsRedirection GetFileAttributesExW GetDiskFreeSpaceExW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW CreateMutexW WaitForSingleObject ReleaseMutex CreateEventW SetEvent CreateThread UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery CreateProcessW GetExitCodeProcess ResetEvent WaitForSingleObjectEx GetSystemInfo LoadLibraryExA

advapi32

RegSetValueExA SetSecurityDescriptorDacl GetAclInformation SetSecurityDescriptorOwner GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD SetSecurityDescriptorGroup RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExW RegOpenKeyExA RegDeleteValueA

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shell32

SHGetKnownFolderPath ord680 CommandLineToArgvW SHGetFolderPathW

user32

CharLowerBuffW MessageBoxW

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

noriskclient-launcher-v3.exe

IMPHASH 6c896e12950cd652444c0b9a3e92e038
SHA256 901e8c031debaf480a1a51e42dabf795d7c86ae43c97b4d17a856baa54c6bd4a
MD5 3e515fe9d6add95f65fd1acc36813c94
SHA1 2b6158f308295af7ae55a2b216ebcc2254d8baa5
SHA512 6ce24ba33734aedbf8740ef3815419fc82fb39a44c3e1668e384e2f10f9a740d87f5a7683ecd29b7996966104c41291d4342cabcbcc59661ef613b56ac32074c
SSDEEP 393216:eHgFuXwFbYBcW3z6j/MOXvQFBObpvDrOPnjYgAx3:eHgFugZYeW3z6jXXvOBOdWDG
TLSH
T16967BE03F29181E8C0AEC478835AE637FB71BC994925B25B5BE47B112F79F50AB0D319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14765504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

noriskclient_launcher_v3.pdb

advapi32

RegDeleteTreeW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW GetUserNameW RegCreateKeyTransactedW RegOpenKeyTransactedW RegSetValueExW RegCloseKey RegGetValueW ImpersonateAnonymousToken SystemFunction036 OpenProcessToken IsValidSid GetLengthSid CopySid GetTokenInformation LookupAccountSidW EventRegister EventSetInformation EventWriteTransfer EventUnregister RevertToSelf

kernel32

GetSystemInfo FlsFree LoadLibraryExA EncodePointer FlsSetValue FlsGetValue FlsAlloc GetTickCount FormatMessageA GetSystemTime GetSystemTimeAsFileTime HeapDestroy HeapCompact FlushViewOfFile OutputDebugStringW HeapSize HeapValidate OutputDebugStringA HeapCreate RaiseException LoadLibraryExW MapViewOfFile RtlPcToFileHeader HeapFree UnregisterWaitEx GlobalMemoryStatusEx SleepConditionVariableSRW WakeAllConditionVariable GetTimeZoneInformationForYear SystemTimeToFileTime GetTickCount64 GetLogicalProcessorInformationEx GetComputerNameExW VirtualProtect FormatMessageW Sleep AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalAlloc VirtualQueryEx ReadProcessMemory OpenProcess GetProcessIoCounters HeapReAlloc GetCurrentThread SetThreadStackGuarantee GetSystemTimePreciseAsFileTime GetSystemTimes GetProcessTimes SetWaitableTimer HeapAlloc SwitchToThread UnmapViewOfFile GetProcessHeap WaitForMultipleObjects GetLastError GetModuleFileNameW GetWindowsDirectoryW GetUserDefaultUILanguage LCIDToLocaleName GetSystemDirectoryW MultiByteToWideChar GlobalFree ExitProcess GetProcessId GetCurrentProcessId RegisterWaitForSingleObject lstrlenW ReleaseMutex GlobalUnlock GlobalLock SleepEx RtlLookupFunctionEntry WideCharToMultiByte GlobalSize DuplicateHandle SetLastError GetModuleHandleW SetHandleInformation CompareStringOrdinal LocalFree GetModuleHandleA FreeLibrary ReleaseSemaphore WaitForSingleObjectEx GetCurrentThreadId LoadLibraryW LoadLibraryA GetProcAddress GetExitCodeProcess WaitForSingleObject TerminateProcess GetCurrentProcess CloseHandle CreateSemaphoreW SetFilePointerEx LockFileEx CreateMutexW SetFileAttributesW MoveFileExW InitializeSListHead SetFileTime FindClose SetConsoleTextAttribute GetLogicalDrives CreateFileMappingW GetFinalPathNameByHandleW SetEnvironmentVariableW SetUnhandledExceptionFilter RtlUnwindEx GetConsoleScreenBufferInfo GetStdHandle GetVolumeInformationW GetDriveTypeW GetVolumePathNamesForVolumeNameW FindVolumeClose FindNextVolumeW AddVectoredExceptionHandler InitializeCriticalSectionEx GetQueuedCompletionStatusEx DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AreFileApisANSI WriteFile GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW CreateFileA DeleteFileA UnlockFile GetFileSize PostQueuedCompletionStatus Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetPerformanceInfo GetDiskFreeSpaceExW FindNextFileW CreateWaitableTimerExW DeviceIoControl CreateHardLinkW CreateSymbolicLinkW CopyFileExW DeleteFileW RemoveDirectoryW GetTempPathW GetCommandLineW GetFileAttributesW CreateProcessW FreeEnvironmentStringsW GetEnvironmentStringsW ReadFile GetOverlappedResult CreateEventW CreateDirectoryW FlushFileBuffers GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW SetFileInformationByHandle GetFullPathNameW CreateThread QueryPerformanceCounter QueryPerformanceFrequency WriteFileEx ReadFileEx GetEnvironmentVariableW WriteConsoleW GetConsoleOutputCP GetConsoleMode CreateMutexA GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext CancelIo ReadDirectoryChangesW CreateFileW SetFileCompletionNotificationModes CreateIoCompletionPort FindFirstVolumeW

ole32

CoUninitialize CoSetProxyBlanket CoInitializeEx CoCreateInstance CoInitialize RegisterDragDrop CoInitializeSecurity OleInitialize RevokeDragDrop

comctl32

TaskDialogIndirect RemoveWindowSubclass DefSubclassProc SetWindowSubclass

shlwapi

SHCreateMemStream

shell32

SHCreateItemFromParsingName CommandLineToArgvW SHOpenFolderAndSelectItems ShellExecuteW ILCreateFromPathW ILFree DragQueryFileW SHAppBarMessage SHGetKnownFolderPath Shell_NotifyIconGetRect DragFinish Shell_NotifyIconW ShellExecuteExW

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree CoTaskMemAlloc

ntdll

NtCreateNamedPipeFile RtlGetVersion NtDeviceIoControlFile NtCancelIoFileEx NtCreateFile NtReadFile NtOpenFile NtWriteFile NtQueryInformationProcess RtlNtStatusToDosError NtQuerySystemInformation

oleaut32

SysFreeString SysAllocString VariantClear SafeArrayGetLBound SafeArrayGetUBound SetErrorInfo SafeArrayAccessData GetErrorInfo SysStringLen SafeArrayUnaccessData SysAllocStringLen

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

user32

CreateAcceleratorTableW RegisterClassW DestroyAcceleratorTable DestroyIcon DestroyMenu AppendMenuW SetMenuItemInfoW ReleaseDC DrawIconEx GetMenuItemInfoW CreateMenu DispatchMessageA EnumChildWindows PostMessageW InsertMenuW EmptyClipboard SetClipboardData CreatePopupMenu RegisterClipboardFormatW CloseClipboard EnableMenuItem SetFocus GetWindow DrawMenuBar CheckMenuItem CreateWindowExW GetMessageA CreateIcon RegisterClassExW OpenClipboard SetMenu GetActiveWindow FindWindowW SendMessageW TranslateAcceleratorW DestroyWindow GetDC GetClipboardData IsClipboardFormatAvailable MapVirtualKeyW GetUpdateRect ValidateRect SystemParametersInfoA DispatchMessageW ShowWindow PostQuitMessage GetMenuBarInfo GetClientRect MapWindowPoints GetWindowRect GetRawInputData MsgWaitForMultipleObjectsEx PeekMessageW PostThreadMessageW ChangeWindowMessageFilterEx RemoveMenu DefWindowProcW SetWindowLongPtrW AdjustWindowRect SetTimer KillTimer GetParent SetWindowRgn FindWindowExW RedrawWindow GetWindowLongPtrW CloseTouchInputHandle GetTouchInputInfo ScreenToClient TrackMouseEvent SystemParametersInfoW GetAsyncKeyState FlashWindowEx LoadCursorW SetCursor IsIconic GetMessageW RegisterTouchWindow IsWindow SetCursorPos UpdateWindow InvalidateRect GetForegroundWindow IsWindowEnabled SetWindowTextW IsWindowVisible GetWindowTextW GetWindowTextLengthW EnableWindow SetParent SetPropW MonitorFromRect SetCapture EnumDisplayMonitors MonitorFromPoint ShowCursor ClipCursor GetSystemMetrics GetClipCursor RegisterRawInputDevices SetWindowDisplayAffinity ReleaseCapture GetKeyState ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyboardState GetWindowPlacement GetMonitorInfoW SetWindowPlacement ChangeDisplaySettingsExW AdjustWindowRectEx GetMenu GetWindowLongW SetWindowLongW GetSystemMenu InvalidateRgn RegisterWindowMessageA TranslateMessage SetWindowPos IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect GetWindowDC OffsetRect

gdi32

CreateSolidBrush DeleteDC CreateRectRgn SelectObject DeleteObject CreateDIBSection CreateCompatibleDC GetDeviceCaps GetDIBits CreateDIBitmap SetTextColor BitBlt CombineRgn SetBkMode

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer DeleteSecurityContext EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken DecryptMessage FreeCredentialsHandle LsaEnumerateLogonSessions AcquireCredentialsHandleA QueryContextAttributesW

ws2_32

sendto recvfrom WSASend shutdown send listen freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt bind recv WSASocketW WSAIoctl connect getsockopt ioctlsocket socket getsockname getpeername WSAGetLastError accept closesocket

bcrypt

BCryptGenRandom

psapi

GetPerformanceInfo GetModuleFileNameExW GetProcessMemoryInfo

pdh

PdhRemoveCounter PdhAddEnglishCounterW PdhEnumObjectsA PdhOpenQueryA PdhCollectQueryData PdhCloseQuery PdhGetFormattedCounterValue

iphlpapi

GetAdaptersAddresses GetIfTable2 FreeMibTable

netapi32

NetUserGetInfo NetUserGetLocalGroups NetApiBufferFree NetUserEnum

crypt32

CertOpenStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateContext CertGetCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore CertDuplicateStore CertDuplicateCertificateContext CertCloseStore

powrprof

CallNtPowerInformation

api-ms-win-crt-math-l1-1-0

_dclass fabs log exp truncf floor sin cos ceilf pow __setusermatherr exp2f floorf roundf ceil round trunc

api-ms-win-crt-string-l1-1-0

wcslen strncmp strspn _wcsicmp strcspn strcmp strlen strcpy_s wcscmp

api-ms-win-crt-runtime-l1-1-0

__p___argv abort _cexit strerror _c_exit terminate _crt_atexit _register_onexit_function _register_thread_local_exe_atexit_callback _initterm _beginthreadex _initialize_onexit_table _endthreadex _exit exit _initterm_e _get_initial_narrow_environment __p___argc _wassert _seh_filter_exe _set_app_type _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode _msize malloc realloc free _callnewh

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

NoRiskClient-Windows-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

$TEMP/MicrosoftEdgeWebview2Setup.exe

PE Signature issue

kernel32

advapi32

ole32

shell32

user32

generic

noriskclient-launcher-v3.exe

advapi32

kernel32

ole32

comctl32

shlwapi

shell32

combase

ntdll

oleaut32

dwmapi

user32

gdi32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

secur32

ws2_32

bcrypt

psapi

pdh

iphlpapi

netapi32

crypt32

powrprof

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0