capa

capa is the FLARE team's tool to identify capabilities in executable
files. Run it against a PE, ELF or .NET module, or raw shellcode, and it
tells you what the program can do: for example, that it acts as a
backdoor, installs a service or communicates over HTTP. Results are
mapped to MITRE ATT&CK and the Malware Behavior Catalog. The standard
rule set and FLIRT library signatures are included.

Examples

capa suspicious.exe

capa -vv suspicious.exe

capa --json suspicious.exe > report.json

capa -f sc64 shellcode.bin

capa -r ~/capa-rules suspicious.exe

capa.show-features suspicious.exe

Backends

The vivisect and .NET backends, BinExport2 files, capa freeze files
and CAPE, DRAKVUF and VMRay sandbox reports are supported. The IDA,
Binary Ninja and Ghidra backends need those programs installed on the
host and are unavailable.

File access

capa can analyze files in your home directory. To analyze files on USB
drives and other removable media (/media, /mnt), run:

sudo snap connect capa:removable-media