clip.exe

File Path: C:\windows\SysWOW64\clip.exe
Description: Clip - copies the data into clipboard

Hashes

Type	Hash
MD5	`1DD4C19B016FC95E7B2236DA1DE8845C`
SHA1	`6174686DF79FB5526668D45B17D607116BC681A3`
SHA256	`3C677C3B2552414B11013DEAC07C80C12139F71D66064C8E0A255C92CC625E0C`
SHA384	`AF19772900759F221B66B73C6D0AD5167E5318BA2F47921B45D6E76E27A9003516FB9CBFEE3E56C819B2B2657921C2A5`
SHA512	`483EF5780B0F293522588047ECA949A5D73FF9560DB629F4EDE48DBC9C835EDFBFC99AB6B32998854E18E584FD5211A53C24E7D2E8D7A0A5C541DE171C8FC9BC`
SSDEEP	`384:1LOP0eBg+HfPdbo9NfFaoFoO+ufarg5E37Zq/twa1STXTddgQO55WFZxoxtBs7Nu:1LOPNBDYNfFv8h37Utwa18dkCLxox07w`

Signature

Status: The file C:\windows\SysWOW64\clip.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
Serial: ``
Thumbprint: ``
Issuer:
Subject:

File Metadata

Original Filename: clip.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
Product Version: 6.3.9600.16384
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of clip.exe being misused. While clip.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	win_invoke_obfuscation_clip_services_security.yml	`description: Detects Obfuscated use of Clip.exe to execute PowerShell`	DRL 1.0
sigma	win_invoke_obfuscation_via_use_clip_services_security.yml	`description: Detects Obfuscated Powershell via use Clip.exe in Scripts`	DRL 1.0
sigma	win_invoke_obfuscation_clip_services.yml	`description: Detects Obfuscated use of Clip.exe to execute PowerShell`	DRL 1.0
sigma	win_invoke_obfuscation_via_use_clip_services.yml	`description: Detects Obfuscated Powershell via use Clip.exe in Scripts`	DRL 1.0
sigma	posh_pm_invoke_obfuscation_clip.yml	`description: Detects Obfuscated use of Clip.exe to execute PowerShell`	DRL 1.0
sigma	posh_pm_invoke_obfuscation_via_use_clip.yml	`description: Detects Obfuscated Powershell via use Clip.exe in Scripts`	DRL 1.0
sigma	posh_ps_invoke_obfuscation_clip.yml	`description: Detects Obfuscated use of Clip.exe to execute PowerShell`	DRL 1.0
sigma	posh_ps_invoke_obfuscation_via_use_clip.yml	`description: Detects Obfuscated Powershell via use Clip.exe in Scripts`	DRL 1.0
sigma	proc_creation_win_clip.yml	`OriginalFileName: clip.exe`	DRL 1.0
sigma	proc_creation_win_invoke_obfuscation_clip.yml	`description: Detects Obfuscated use of Clip.exe to execute PowerShell`	DRL 1.0
sigma	proc_creation_win_invoke_obfuscation_via_use_clip.yml	`description: Detects Obfuscated Powershell via use Clip.exe in Scripts`	DRL 1.0
sigma	driver_load_invoke_obfuscation_clip+_services.yml	`description: Detects Obfuscated use of Clip.exe to execute PowerShell`	DRL 1.0
sigma	driver_load_invoke_obfuscation_via_use_clip_services.yml	`description: Detects Obfuscated Powershell via use Clip.exe in Scripts`	DRL 1.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

clip

Redirects the command output from the command line to the Windows clipboard. You can use this command to copy data directly into any application that can receive text from the Clipboard. You can also paste this text output into other programs.

Syntax

<command> | clip
clip < <filename>

Parameters

Parameter	Description
`<command>`	Specifies a command whose output you want to send to the Windows clipboard.
`<filename>`	Specifies a file whose contents you want to send to the Windows clipboard.
/?	Displays help at the command prompt.

Examples

To copy the current directory listing to the Windows clipboard, type:

dir | clip

To copy the output of a program called generic.awk to the Windows clipboard, type:

awk -f generic.awk input.txt | clip

To copy the contents of a file called readme.txt to the Windows clipboard, type:

clip < readme.txt

Additional References

Command-Line Syntax Key