capa is a binary analysis tool that identifies capabilities in executable files by analyzing their code and behavior patterns.
The tool addresses the challenge of quickly understanding what an unknown executable can do without manual reverse engineering. It works by matching patterns within PE, ELF, .NET, and shellcode files against a rule-based detection system, reporting capabilities like service installation, HTTP communication, data encoding, and process spawning. The tool can also analyze sandbox reports from CAPE, DRAKVUF, and VMRay to detect capabilities from dynamic execution traces. Results include verbose output showing exactly where evidence of each capability was found within the binary, enabling analysts to verify conclusions and locate relevant code sections for deeper investigation.
Analysts performing malware triage and threat intelligence work should consider capa when they need rapid capability assessment of unknown binaries. The tool suits workflows where quick identification of suspicious behaviors informs whether to proceed with sandbox execution or deeper reverse engineering. The project provides a web-based interface called capa Explorer Web for interactive browsing of results, available both online and as a standalone HTML file for offline use. Standalone binaries are available for direct execution without installation, though the tool can also be integrated as a library into other analysis platforms.
The project maintains an active rule repository separate from the core tool, allowing the detection capabilities to evolve independently. Development includes support for multiple binary formats and sandbox platforms, indicating ongoing expansion of analysis scope. The tool is designed for both command-line usage and programmatic integration, reflecting attention to different analyst workflows.
