LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Extrac32.exe

View source

Extract to ADS, copy or overwrite a file with Extrac32.exe

ADSDownloadCopy
04COMMAND EXAMPLES
02ATT&CK TECHNIQUES
03DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

4 examples

ADS2

EXAMPLE 01T1564.004

Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.

COMMAND
extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe
USE CASE
Extract data from cab file and hide it in an alternate data stream.
PRIVILEGES
User
OPERATING SYSTEM
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Type · Compression
EXAMPLE 02T1564.004

Extracts the source CAB file on an unc path into an Alternate Data Stream (ADS) of the target file.

COMMAND
extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe
USE CASE
Extract data from cab file and hide it in an alternate data stream.
PRIVILEGES
User
OPERATING SYSTEM
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Type · Compression

Download1

EXAMPLE 01T1105

Copy the source file to the destination file and overwrite it.

COMMAND
extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}
USE CASE
Download file from UNC/WEBDav
PRIVILEGES
User
OPERATING SYSTEM
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Copy1

EXAMPLE 01T1105

Command for copying file from one folder to another

COMMAND
extrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}
USE CASE
Copy file
PRIVILEGES
User
OPERATING SYSTEM
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\extrac32.exe
C:\Windows\SysWOW64\extrac32.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

egre55@egre55
Oddvar Moe@oddvarmoe
Hai Vaknin(Lux@VakninHai
Tamir Yehuda@tim8288