cabinet.dll
Microsoft Cabinet File API file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real cabinet.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Cabinet File API
2 known copies
5.00 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cabinet.dll · signed by Microsoft Windows
53cdccaf41fedd8de8e08de655f2dc3750bb295e6c372b27c46bfca35cef2c8d5.00 (WinBuild.160101.0800) · C:\Windows\system32\cabinet.dll · signed by Microsoft Windows
c486a6f9715d1900989740698f0bb5969e1df537fa3da4174bd63d6807bec9b1From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names cabinet.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.