AwesomeREA.org

Tool

capa

Mandiant FLARE tool that reports what an executable can do by matching a YAML rule set against features extracted from PE, ELF and .NET files or 32/64-bit shellcode, such as API calls, imports, strings and constants. Matches are grouped into capability namespaces with ATT&CK and MBC tags, and verbose output shows the function or basic-block addresses and features behind each match, pointing analysts to code worth studying. It also reads CAPE, DRAKVUF and VMRay sandbox reports for dynamic features and can use vivisect, IDA Pro, Ghidra or Binary Ninja for analysis, with explorer plugins for IDA and Ghidra and a browser viewer for its JSON results.

Requirements and limitations

  • Release at review: v10.0.0, published 2026-10-16, with standalone PyInstaller builds for Linux (x86_64, arm64 and a Python 3.13 variant), macOS (x86_64 and arm64) and Windows that run without installation; the reviewed master commit only syncs the rules submodule after that tag. The installation guide says the Linux build needs GLIBC 2.26+ and that macOS Gatekeeper must approve the binary on first run. The flare-capa PyPI package (10.0.0, Python 3.10+) does not include the default rules or library-identification signatures, which are passed with -r and -s.
  • Inputs are user-supplied PE, ELF or .NET modules, raw shellcode, CAPE, DRAKVUF or VMRay reports, BinExport2 files or saved capa feature files. The IDA Pro explorer needs IDA 7.4+ with Python 3.10+ (tested through IDA 9.0); the Ghidra backend and explorer script need Ghidra 12.0+ started through PyGhidra; the Binary Ninja backend uses a separately installed Binary Ninja.
  • The limitations guide states that packed or obfuscated programs, installers and packaged programs such as AutoIt give misleading or incomplete results, and that capabilities split across wrapper or child functions are not matched; capa warns when its rules detect packing or installers. Matches are rule-based indications of capability, not confirmed behavior.
  • Apache-2.0, as is the separate capa-rules repository. v10.0.0 fixes code execution through crafted vivisect .viv workspace files, which affected v9.4.0 and earlier; existing workspaces now load only with CAPA_LOAD_VIV_WORKSPACE=1. A recursive source clone also fetches the test-file submodule, which the installation guide warns contains many malware samples. No samples were analyzed.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · mandiant/capa · Revision 7a235c4
  2. README.md#L153-L160 GitHub · mandiant/capa · Revision 7a235c4
  3. doc/installation.md GitHub · mandiant/capa · Revision 7a235c4
  4. doc/usage.md GitHub · mandiant/capa · Revision 7a235c4
  5. doc/limitations.md GitHub · mandiant/capa · Revision 7a235c4
  6. capa/loader.py#L65-L75 GitHub · mandiant/capa · Revision 7a235c4
  7. capa/ida/plugin/README.md#L97-L110 GitHub · mandiant/capa · Revision 7a235c4
  8. capa/ghidra/README.md GitHub · mandiant/capa · Revision 7a235c4
  9. pyproject.toml GitHub · mandiant/capa · Revision 7a235c4
  10. LICENSE.txt GitHub · mandiant/capa · Revision 7a235c4
  11. https://github.com/mandiant/capa/releases/tag/v10.0.0
  12. https://pypi.org/project/flare-capa/10.0.0/