capa

capa detects capabilities in executable files and reports what a program can do. Run it against PE, ELF, and .NET modules, shellcode, or sandbox reports to surface behaviors such as service installation, HTTP communication, or backdoor-like activity.

It runs from the terminal as a standalone binary, or as a Python library. Rules match static and dynamic evidence, and the -vv flag pinpoints exactly where each supporting feature was found. Dynamic analysis can consume sandbox reports from CAPE, DRAKVUF, and VMRay, and capa Explorer Web shows results in a browser, including a single offline HTML file.

It ships with hundreds of curated rules and plugs into IDA Pro and Ghidra, so reverse engineers and malware analysts can triage samples fast without leaving their disassembler.