capa
Install latest/stable of capa
Ubuntu 16.04 or later?
Make sure snap support is enabled in your Desktop store.
Details for capa
Package name
- capa
License
- Apache-2.0
Last updated
- 3 November 2026 - latest/stable
- 3 November 2026 - latest/candidate
Websites
Contact
Source code
Report a bug
External link warning
You are about to open
Do you wish to proceed?
Report a Snap Store violation
Report capa for a Snap Store violation
Snap Store Violation Report submitted successfully
Thank you for your report. Information you provided will help us investigate further.
Error submitting report
There was an error while sending your report. Please try again later.
Share this snap
Generate an embeddable card to be shared on external websites.
Identify capabilities in executable files
capa is the FLARE team's tool to identify capabilities in executable files. Run it against a PE, ELF or .NET module, or raw shellcode, and it tells you what the program can do: for example, that it acts as a backdoor, installs a service or communicates over HTTP. Results are mapped to MITRE ATT&CK and the Malware Behavior Catalog. The standard rule set and FLIRT library signatures are included.
Examples
capa suspicious.exe
capa -vv suspicious.exe
capa --json suspicious.exe > report.json
capa -f sc64 shellcode.bin
capa -r ~/capa-rules suspicious.exe
capa.show-features suspicious.exe
Backends
The vivisect and .NET backends, BinExport2 files, capa freeze files and CAPE, DRAKVUF and VMRay sandbox reports are supported. The IDA, Binary Ninja and Ghidra backends need those programs installed on the host and are unavailable.
File access
capa can analyze files in your home directory. To analyze files on USB drives and other removable media (/media, /mnt), run:
sudo snap connect capa:removable-media
| Revision | Channel | Version | Build | Commit | Download SBOM |
|---|
The build and commit information is derived from build infrastructure records.
Install capa on your Linux distribution
Choose your Linux distribution to get detailed installation instructions. If yours is not shown, get more details on the installing snapd documentation.
