clip.exe

  • File Path: C:\WINDOWS\system32\clip.exe
  • Description: Clip - copies the data into clipboard

Hashes

Type Hash
MD5 EDC92D297EFE052CD060177AFA7454F4
SHA1 E2991612243DCB4630F74432FA07FBC527C89469
SHA256 CB7ED224B854C6503928DAB334F1E0E42CBBB9617B187E5E86ACD4E03858879F
SHA384 4C585E4D07C8C83CB2A3D43DB714EAD068BC1B38CE4A39B65859AF76EC7BF48479B5BF9584A81D6848AF9DA2E813C552
SHA512 AC77968B2775F198AA513120E5BEE2EB4B2D7E2571857BBC260F9E858ACDCE439CB58369C8AE1FC51E00FB347512FF05D789B46ACA5225F76143FD1194712E34
SSDEEP 768:3umIpn/qkY03jF3OLvyJ6edMeju9eXefUNh2xKoY5L:3wuv8Ceju9YefDxTY5

Runtime Data

Usage (stdout):


CLIP

Description:
    Redirects output of command line tools to the Windows clipboard.
    This text output can then be pasted into other programs.

Parameter List:
    /?                  Displays this help message.

Examples:
    DIR | CLIP          Places a copy of the current directory
                        listing into the Windows clipboard.

    CLIP < README.TXT   Places a copy of the text from readme.txt
                        on to the Windows clipboard.

Usage (stderr):

ERROR: Invalid argument/option - '-help'.
Type "CLIP /?" for usage.

Signature

  • Status: Signature verified.
  • Serial: 330000023241FB59996DCC4DFF000000000232
  • Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: clip.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.18362.1 (WinBuild.160101.0800)
  • Product Version: 10.0.18362.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of clip.exe being misused. While clip.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma win_invoke_obfuscation_clip_services_security.yml description: Detects Obfuscated use of Clip.exe to execute PowerShell DRL 1.0
sigma win_invoke_obfuscation_via_use_clip_services_security.yml description: Detects Obfuscated Powershell via use Clip.exe in Scripts DRL 1.0
sigma win_invoke_obfuscation_clip_services.yml description: Detects Obfuscated use of Clip.exe to execute PowerShell DRL 1.0
sigma win_invoke_obfuscation_via_use_clip_services.yml description: Detects Obfuscated Powershell via use Clip.exe in Scripts DRL 1.0
sigma posh_pm_invoke_obfuscation_clip.yml description: Detects Obfuscated use of Clip.exe to execute PowerShell DRL 1.0
sigma posh_pm_invoke_obfuscation_via_use_clip.yml description: Detects Obfuscated Powershell via use Clip.exe in Scripts DRL 1.0
sigma posh_ps_invoke_obfuscation_clip.yml description: Detects Obfuscated use of Clip.exe to execute PowerShell DRL 1.0
sigma posh_ps_invoke_obfuscation_via_use_clip.yml description: Detects Obfuscated Powershell via use Clip.exe in Scripts DRL 1.0
sigma proc_creation_win_clip.yml OriginalFileName: clip.exe DRL 1.0
sigma proc_creation_win_invoke_obfuscation_clip.yml description: Detects Obfuscated use of Clip.exe to execute PowerShell DRL 1.0
sigma proc_creation_win_invoke_obfuscation_via_use_clip.yml description: Detects Obfuscated Powershell via use Clip.exe in Scripts DRL 1.0
sigma driver_load_invoke_obfuscation_clip+_services.yml description: Detects Obfuscated use of Clip.exe to execute PowerShell DRL 1.0
sigma driver_load_invoke_obfuscation_via_use_clip_services.yml description: Detects Obfuscated Powershell via use Clip.exe in Scripts DRL 1.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


clip

Redirects the command output from the command line to the Windows clipboard. You can use this command to copy data directly into any application that can receive text from the Clipboard. You can also paste this text output into other programs.

Syntax

<command> | clip
clip < <filename>

Parameters

Parameter Description
<command> Specifies a command whose output you want to send to the Windows clipboard.
<filename> Specifies a file whose contents you want to send to the Windows clipboard.
/? Displays help at the command prompt.

Examples

To copy the current directory listing to the Windows clipboard, type:

dir | clip

To copy the output of a program called generic.awk to the Windows clipboard, type:

awk -f generic.awk input.txt | clip

To copy the contents of a file called readme.txt to the Windows clipboard, type:

clip < readme.txt

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.