capa is the FLARE team's tool to identify capabilities in executable files. Run it against a PE, ELF or .NET module, or raw shellcode, and it tells you what the program can do: for example, that it acts as a backdoor, installs a service or communicates over HTTP. Results are mapped to MITRE ATT&CK and the Malware Behavior Catalog. The standard rule set and FLIRT library signatures are included.

Examples

capa suspicious.exe
capa -vv suspicious.exe
capa --json suspicious.exe > report.json
capa -f sc64 shellcode.bin
capa -r ~/capa-rules suspicious.exe
capa.show-features suspicious.exe

Backends

The vivisect and .NET backends, BinExport2 files, capa freeze files and CAPE, DRAKVUF and VMRay sandbox reports are supported. The IDA, Binary Ninja and Ghidra backends need those programs installed on the host and are unavailable.

File access

capa can analyze files in your home directory. To analyze files on USB drives and other removable media (/media, /mnt), run:

sudo snap connect capa:removable-media