{"id":4309,"date":"2017-09-22T23:05:40","date_gmt":"2017-09-22T23:05:40","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4309"},"modified":"2017-09-22T23:09:47","modified_gmt":"2017-09-22T23:09:47","slug":"enter-sandbox-part-15-the-muddy-heavy-water-world-of-atomic-formats","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/09\/22\/enter-sandbox-part-15-the-muddy-heavy-water-world-of-atomic-formats\/","title":{"rendered":"Enter Sandbox \u2013 part 15: The muddy, heavy water world of atomic formats…"},"content":{"rendered":"

Sample analysis process typically covers looking at the most common forensic suspects including mutexes<\/a>, event names<\/a>, and atoms<\/a>. However, there is one more sub-artifact sitting on the same bench<\/a> with the last one I have listed… one that often escapes the scrutiny of sandboxes and malware analysts – the clipboard format.<\/p>\n

The clipboard format is registered using the RegisterClipboardFormat<\/a> function – it allows applications to interchange data as long as they understand the format. The registration is implemented with the use of atoms as explained in this presentation<\/a>.<\/p>\n

Sandboxes and analysts inspecting the calls to RegisterClipboardFormat can use the received data in many ways. It can help to determine a file type of the sample, its modules, detect a family of a malware\/adware, or perhaps a programming framework, and in some cases heuristically detect capabilities of the tested sample. I have listed a few example clipboard formats below. If you look at it one set that immediately stands out are Delphi clipboard formats:<\/p>\n