makecab.exe

  • File Path: C:\WINDOWS\SysWOW64\makecab.exe
  • Description: Microsoft Cabinet Maker

Hashes

Type Hash
MD5 2A6E021A5E8E6F04F36EED5CADC472F0
SHA1 2F1C71ADED916DD131CEE25C439A5024E6D062CB
SHA256 DA0A9DEE221007B711C31C974B8DFFF2F56744D347669DA7E468914BD4096D31
SHA384 E295B4977A5E81F72BDF63286763FAE845F5BEB897305F57330E46D790F30FF1FE7DA1644A01517FBA32B02895F483C3
SHA512 DA19CFCB6F140262035932E4ADF77CB65C7AD4E4F4AE88DBB9BE4C90C9192B4A37FDE3938C55E3377073CC892A7CCAE62E2C6B899E23159CD0F7CD0422E23FEE
SSDEEP 1536:PHETNBgUEt6H091wjM/b3sWNhIkH4oSlblnTGPptnJTliYcZpZgoLA4pnj1mOS1I:PETNyUEt6H091wjM/b3sWNhIkHjSlbZH

Runtime Data

Usage (stdout):

Cabinet Maker - Lossless Data Compression Tool

MAKECAB [/V[n]] [/D var=value ...] [/L dir] source [destination]
MAKECAB [/V[n]] [/D var=value ...] /F directive_file [...]

  source         File to compress.
  destination    File name to give compressed file.  If omitted, the
                 last character of the source file name is replaced
                 with an underscore (_) and used as the destination.
  /F directives  A file with MakeCAB directives (may be repeated). Refer to
                 Microsoft Cabinet SDK for information on directive_file.
  /D var=value   Defines variable with specified value.
  /L dir         Location to place destination (default is current directory).
  /V[n]          Verbosity level (1..3).

Signature

  • Status: Signature verified.
  • Serial: 330000023241FB59996DCC4DFF000000000232
  • Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: makecab.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 5.00 (WinBuild.160101.0800)
  • Product Version: 5.00
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of makecab.exe being misused. While makecab.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma sysmon_suspicious_remote_thread.yml - '\makecab.exe' DRL 1.0
sigma proc_creation_win_alternate_data_streams.yml - 'makecab ' DRL 1.0
sigma proc_creation_win_apt_hafnium.yml Image\|endswith: '\makecab.exe' DRL 1.0
LOLBAS Makecab.yml Name: Makecab.exe  
LOLBAS Makecab.yml - Command: makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab  
LOLBAS Makecab.yml - Command: makecab \\webdavserver\webdav\file.exe C:\Folder\file.txt:file.cab  
LOLBAS Makecab.yml - Command: makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab  
LOLBAS Makecab.yml - Path: C:\Windows\System32\makecab.exe  
LOLBAS Makecab.yml - Path: C:\Windows\SysWOW64\makecab.exe  
LOLBAS Makecab.yml - IOC: Makecab retrieving files from Internet  
LOLBAS Makecab.yml - IOC: Makecab storing data into alternate data streams  
atomic-red-team T1564.004.md makecab #{path}\autoruns.exe #{path}\cabtest.txt:autoruns.cab MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


makecab

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Package existing files into a cabinet (.cab) file.

[!NOTE] This command is the same as the diantz command.

Syntax

makecab [/v[n]] [/d var=<value> ...] [/l <dir>] <source> [<destination>]
makecab [/v[<n>]] [/d var=<value> ...] /f <directives_file> [...]

Parameters

Parameter Description
<source> File to compress.
<destination> File name to give compressed file. If omitted, the last character of the source file name is replaced with an underscore (_) and used as the destination.
/f <directives_file> A file with makecab directives (may be repeated).
/d var=<value> Defines variable with specified value.
/l <dir> Location to place destination (default is current directory).
/v[<n>] Set debugging verbosity level (0=none,…,3=full).
/? Displays help at the command prompt.

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.