capa - The FLARE team's open-source tool to identify capa

项目说明

<br />
<di="center">
<a href=" target="_blank">
<img src="
</a>
<p align="center">
<a href=" target="_blank">Website</a>
|
<a href=" target="_blank">Download</a>
|
<a href=" target="_blank">Web Interface</a>
</p>
<di="center">

![PyPI - Python ]()
![Last release]()
![Number of rules]()
![CI status]()
![Downloads]()

</div>
</div>

---

capa detects capabilities in executable files.
You run it against a PE, ELF, .NET module, shellcode file, or a sandbox report and it tells you what it thinks the program can do.
For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.

To interactively inspect capa results in your browser use the capa Explorer Web.

If you want to inspect or write capa rules, head on over to the capa-rules repository. Otherwise, keep reading.

Below you find a list of our capa blog posts with more details.

example capa output

download and usage

Download stable releases of the standalone capa binaries here. You can run the standalone binaries without installation. capa is a command line tool that should be run from the terminal.

To use capa as a library or integrate with another tool, see doc/installation.md for further setup instructions.

Documentation: Usage and tips · Installation · Limitations · FAQ

capa Explorer Web

The capa Explorer Web enables you to interactively explore capa results in your web browser. Besides the online you can download a standalone HTML file for local offline usage.

!capa Explorer Web screenshot

More details on the web UI is a in the capa Explorer Web README.

example

In the abo output, we run capa against an unknown binary (suspicious.exe),
and the tool reports that the program can send HTTP requests, decode data via XOR and Base64,
install services, and spawn new processes.
Taken together, this makes us think that suspicious.exe could be a persistent backdoor.
Therefore, our next analysis step might be to run suspicious.exe in a sandbox and try to recover the command and control server.

detailed results

By passing the -vv flag (for very ), capa reports exactly where it found e of these capabilities.
This is useful for at least two reasons:

- it helps explain why we should trust the results, and enables us to the conclusions, and
- it shows where within the binary an experienced analyst might study with IDA Pro

dynamic capa

capa also supports dynamic capabilities detection for multiple sandboxes including:
* CAPE (supported report formats: .json, .json_, .json.gz)
* DRAKVUF (supported report formats: .log, .log.gz)
* VMRay (supported report formats: analysis archive .zip)

To use this feature, submit your file to a supported sandbox and then download and run capa against the generated report file. This feature enables capa to match capabilities against dynamic and static features that the sandbox captured during execution.

Here's an example of running capa against a packed file, and then running capa against the CAPE report generated for the same packed file:

capa rules

capa uses a collection of rules to identify capabilities within a program.
These rules are easy to write, even for those new to reverse engineering.
By authoring rules, you can extend the capabilities that capa recognizes.
In some regards, capa rules are a mixture of the OpenIOC, Yara, and YAML formats.

Here's an example rule used by capa:

The github.com/mandiant/capa-rules repository contains hundreds of standard rules that are distributed with capa.
Please learn to write rules and contribute new entries as you find interesting techniques in malware.

IDA Pro plugin: capa explorer

If you use IDA Pro, then you can use the capa explorer plugin.
capa explorer helps you identify interesting areas of a program and build new capa rules using features extracted directly from your IDA Pro database.
It also uses your local changes to the .idb to extract better features, such as when you rename a global that contains a dynamically resolved API address.

!capa + IDA Pro integration

Ghidra integration

capa supports using Ghidra (via PyGhidra) as a feature extraction backend. This allows you to run capa against binaries using Ghidra's analysis engine.

You can run and view capa results in the Ghidra UI using capa explorer for Ghidra.

<img src=" width=300>

You can also run capa from the command line using the Ghidra backend.

blog posts

Riding Dragons: capa Harnesses Ghidra

Dynamic capa: Exploring Executable Run-Time Behavior with the CAPE Sandbox

capa v4: casting a wider .NET (.NET support)

ELFant in the Room – capa v3 (ELF support)

capa 2.0: Better, Stronger, Faster

capa: Automatically Identify Malware Capabilities

further information

capa

Installation

Usage

Limitations

Contributing Guide

capa rules

capa-rules repository

capa-rules rule format

capa testfiles

The capa-testfiles repository contains the data we use to test capa's code and rules

mailing list

Subscribe to the FLARE mailing list for community announcements! Email "subscribe" to .

项目信息

开发语言：Python

Star 数：6210

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕The FLARE team's open-source tool to identify capabilities in executable files.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。