extrac32.exe

Microsoft CAB File Extract Utility file version info (xCyclopedia)

LOLBAS ADS, Download, Copy 1 Sigma rule name it 2 ATT&CK techniques 4 documented commands 12 known copies with hashes

How extrac32.exe is abused

documented by LOLBAS

ADS T1564.004 Hide Artifacts: NTFS File Attributes

Download T1105 Ingress Tool Transfer

-y

-c

Copy T1105 Ingress Tool Transfer

-c

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for extrac32.exe.

4 documented commands

from LOLBAS, each read by the identifier

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.

extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe

Identify

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Extracts the source CAB file on an unc path into an Alternate Data Stream (ADS) of the target file.

extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe

Identify

Download T1105 Ingress Tool Transfer User privileges

Copy the source file to the destination file and overwrite it.

extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}

Identify

Copy T1105 Ingress Tool Transfer User privileges

Command for copying file from one folder to another

extrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}

Identify

None of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for extrac32.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for extrac32.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumSuspicious Extrac32 Executionfrack113

T1105Ingress Tool Transfer

T1564.004Hide Artifacts: NTFS File Attributes

Is it the real extrac32.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft CAB File Extract Utility

12 known copies

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\extrac32.exe · not signed

8e0e651a59fdf07f2161d2578baa97ba6de8b624f4ab9a17d3c633f4a060b522

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\extrac32.exe · not signed

f9bf62d035a1d21353fe359e178a75895b1b328cfe8e17b6777558bc47985290

5.00 (rs1_release.160715-1616) · C:\Windows\system32\extrac32.exe · signed by Microsoft Windows

2b44acf71844632f2f24a622ee152af553aea63b12a42bb90095111ae13c6913

5.00 (rs1_release.160715-1616) · C:\Windows\SysWOW64\extrac32.exe · signed by Microsoft Windows

fa7417fcc312a734880bec3a890488a8f90ed4cf0a55f56bc8a8c065521817dc

5.00 (WinBuild.160101.0800) · C:\Windows\SysWOW64\extrac32.exe · signed by Microsoft Windows

2e2cafd7954a9fb3fd321194bd3bb691cecee01189a51e821ed1b40dce929007

5.00 (WinBuild.160101.0800) · C:\Windows\system32\extrac32.exe · signed by Microsoft Windows

53bef52aa01713756db903dc6a6983543217219d898b78e75b0e0642c02bbd45

5.00 (WinBuild.160101.0800) · C:\WINDOWS\system32\extrac32.exe · signed by Microsoft Windows

5b6d5384ef38930464b2ea0a915f1d305b2ddb054ae404ea0f3c3f5c659b7086

5.00 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\extrac32.exe · signed by Microsoft Windows

777957b5f985dee9da8c5f5eb017d2a3b35e0b0f7b2c71268ad2dd70f8aa3c61

5.00 (WinBuild.160101.0800) · C:\Windows\system32\extrac32.exe · signed by Microsoft Windows

a224559fd6621066347a5ba8f4aeeceea8a0a7a881a71bd36de69aceb52e9df7

5.00 (WinBuild.160101.0800) · C:\Windows\SysWOW64\extrac32.exe · signed by Microsoft Windows

a91d32973a1097eb1131ff630b0c082406703c48b8f442955dda184c43bce99e

5.00 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\extrac32.exe · signed by Microsoft Windows

bd050055f7e9538cd77c7530649cc17abe9936e488af82e70dd31749e0593c20

5.00 (WinBuild.160101.0800) · C:\WINDOWS\system32\extrac32.exe · signed by Microsoft Windows

f4eff502c423d5bfe12ebfef6f0ec9eb3cb9a1fb668a850edbd2a0d353328393

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

extrac32.exe

How extrac32.exe is abused

4 documented commands

What detects it

Is it the real extrac32.exe?

12 known copies

Other programs abused for ADS