makecab.exe

  • File Path: C:\Windows\SysWOW64\makecab.exe
  • Description: Microsoft Cabinet Maker

Hashes

Type Hash
MD5 00824484BE0BCE2A430D7F43CD9BABA5
SHA1 85DFD8B30399A207B0CFDE6FCBAE03385DD98642
SHA256 F3C190724C35D35DA5213DAEB868DADE5556EAEA69A9337DEDD6402CF4C42E48
SHA384 2564BD4955B5261267AE13B0B4071002A9DD9C97D3CCA9ACC9A1F781886D6CA65814A2A0D19E104BA6A58199AA1545E5
SHA512 7D2522D9CB3B5E9700753B40BA5B99854CBFA2A100B065808F2C7B1C40A565C0AA849B178A544067D05BBB6176C7D7F8B7D4FADED8B2A94B0DC492E94D9F6203
SSDEEP 1536:KHETyr/UEt6k01v/wjM/bCsvmhnEAWykSxHEVcjrIcuj+cZv7gJ/V3pnQgJY+F7+:0ETyzUEt6k01v/wjM/bCsvmhnEAWdSxK
IMP DB419917F8DBA7D951EB3BCBFC2572AA
PESHA1 E701D0D4054AE937856F65F6811E47108AA4C2F9
PE256 74C9BCE815AF297F5997731EA19F6D689B4803E50C4AB6CA0143680BA218BC5A

Runtime Data

Usage (stdout):

Cabinet Maker - Lossless Data Compression Tool

MAKECAB [/V[n]] [/D var=value ...] [/L dir] source [destination]
MAKECAB [/V[n]] [/D var=value ...] /F directive_file [...]

  source         File to compress.
  destination    File name to give compressed file.  If omitted, the
                 last character of the source file name is replaced
                 with an underscore (_) and used as the destination.
  /F directives  A file with MakeCAB directives (may be repeated). Refer to
                 Microsoft Cabinet SDK for information on directive_file.
  /D var=value   Defines variable with specified value.
  /L dir         Location to place destination (default is current directory).
  /V[n]          Verbosity level (1..3).

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\makecab.exe

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: makecab.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 5.00 (WinBuild.160101.0800)
  • Product Version: 5.00
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/75
  • VirusTotal Link: https://www.virustotal.com/gui/file/f3c190724c35d35da5213daeb868dade5556eaea69a9337dedd6402cf4c42e48/detection

Possible Misuse

The following table contains possible examples of makecab.exe being misused. While makecab.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma sysmon_suspicious_remote_thread.yml - '\makecab.exe' DRL 1.0
sigma proc_creation_win_alternate_data_streams.yml - 'makecab ' DRL 1.0
sigma proc_creation_win_apt_hafnium.yml Image\|endswith: '\makecab.exe' DRL 1.0
LOLBAS Makecab.yml Name: Makecab.exe  
LOLBAS Makecab.yml - Command: makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab  
LOLBAS Makecab.yml - Command: makecab \\webdavserver\webdav\file.exe C:\Folder\file.txt:file.cab  
LOLBAS Makecab.yml - Command: makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab  
LOLBAS Makecab.yml - Path: C:\Windows\System32\makecab.exe  
LOLBAS Makecab.yml - Path: C:\Windows\SysWOW64\makecab.exe  
LOLBAS Makecab.yml - IOC: Makecab retrieving files from Internet  
LOLBAS Makecab.yml - IOC: Makecab storing data into alternate data streams  
atomic-red-team T1564.004.md makecab #{path}\autoruns.exe #{path}\cabtest.txt:autoruns.cab MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


makecab

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Package existing files into a cabinet (.cab) file.

[!NOTE] This command is the same as the diantz command.

Syntax

makecab [/v[n]] [/d var=<value> ...] [/l <dir>] <source> [<destination>]
makecab [/v[<n>]] [/d var=<value> ...] /f <directives_file> [...]

Parameters

Parameter Description
<source> File to compress.
<destination> File name to give compressed file. If omitted, the last character of the source file name is replaced with an underscore (_) and used as the destination.
/f <directives_file> A file with makecab directives (may be repeated).
/d var=<value> Defines variable with specified value.
/l <dir> Location to place destination (default is current directory).
/v[<n>] Set debugging verbosity level (0=none,…,3=full).
/? Displays help at the command prompt.

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.