extrac32 - for self-extracting archives (cabinets)

[TAbdiukov]

I'm not sure if this counts as LOLBAS

• [-] the main file is copy.exe, not extrac32.exe
• [+] This usage of EXE is undocumented
• [-] In reality, EXEs are probably more likely to trip detection than .CAB
• [+] For an attacker, it can be useful for covert extractions of payloads without command-line arguments (while maintaining the use of Microsoft EXEs for its headers)

[TAbdiukov]

Example file,
file3.zip

[TAbdiukov]

Another example file, obtained on Windows XP with the following one-liner,

copy /b "C:\WINDOWS\system32\extrac32.exe"+"C:\WINDOWS\pchealth\helpctr\binaries\pchdt_w3.cab" number2.exe

number2.zip