# capa - extract capabilities from executable files

# Extract capabilities from executable files

capa is the FLARE team's free and open-source tool to identify capabilities in executable files. Triage unknown files, guide reverse engineering, and hunt across a corpus for novel malware. Refer to capa's rule set as an encyclopedia of techniques used in real-world attacks, pivoting across MITRE ATT&CK and Malware Behavior Catalog (MBC) references.

Download Browse Rules

# Rules Crafted by Experts

capa recognizes behaviors by matching rules crafted by expert reverse engineers.

Rules describe logical combinations of features familiar to human analysts. Things like:

- API calls, like `CreateRemoteThread`,
- integer constants, like `0x100000001b3 = FNV prime`,
- string references, like `"ZIG_DEBUG_COLOR"`.

capa looks for these features within instructions, basic blocks, and functions, having already disassembled the input file. In contrast to YARA, which primarily searches for sequences of bytes, capa rules describe features at the code-level.

Browse Rules Learn the Syntax

# What's New

## Tool Updates

### v9.3.1 (2025-11-19)

This patch release fixes a missing import for the capa explorer plugin for IDA Pro.

### v9.3.0 (2025-11-12)

capa v9.3.0 comes with over 20 new and/or impoved rules. For IDA users the capa explorer plugin is now available via the IDA Pro plugin repository and contains Qt compatibility layer for PyQt5 and PySide6 support. Additionally a Binary Ninja bug has been fixed. Released binaries now include ARM64 binaries (Linux and macOS).

### v9.2.1 (2025-06-06)

This point release fixes bugs including removing an unnecessary PyInstaller warning message and enabling the standalone binary to execute on systems running older versions of glibc.

### v9.2.0 (2025-06-03)

This release improves a few aspects of dynamic analysis, including relaxing our validation on fields across many CAPE versions and processing additional VMRay submission file types, for example. It also includes an updated rule pack containing new rules and rule fixes.

### v9.1.0 (2025-03-02)

This release improves a few aspects of dynamic analysis, relaxing our validation on fields across many CAPE versions, for example. It also includes an updated rule pack in which many dynamic rules make better use of the "span of calls" scope.

### v9.0.0 (2025-02-05)

This release introduces a new scope for dynamic analysis, "span of calls", that matches features against a across a sliding window of API calls within a thread. Its useful for identifying behaviors that span multiple API calls, such as `OpenFile`/`ReadFile`/`CloseFile`, without having to analyze an entire thread, which may be very long. The release also contains a number of bug fixes and enhancements by new contributors: @v1bh475u and @dhruvak001. Welcome and thank you!

### v8.0.1 (2024-12-09)

This point release fixes an issue with the IDAPython API to now handle IDA Pro 8.3, 8.4, and 9.0 correctly.

### v8.0.0 (2024-12-09)

capa v8.0.0 adds support for IDA Pro 9.0 (and idalib). The release comes with various improvements and bug fixes for the Binary Ninja backend (including to load with database files) -- thanks to @xusheng6.
Additional bug fixes improve the dynamic and BinExport backends.
capa version 8 now requires Python 3.10 or newer.

### v7.4.0 (2024-10-04)

The v7.4.0 capa release fixes a bug when processing VMRay analysis archives and enhances API extraction for all dynamic backends. For better terminal rendering capa now solely relies on the rich library.
The standalone capa executable can now automatically detect installations of relevant third party applications and use their backends (notably, idalib and Binary Ninja). For the extra standalone Linux build we've upgraded from Python 3.11 to 3.12.

### v7.3.0 (2024-09-20)

The capa v7.3.0 release comes with the following three major enhancements:

1. Support for VMRay sandbox analysis archives: Unlock powerful malware analysis with capa's new VMRay sandbox integration! Simply provide a VMRay analysis archive, and capa will automatically extract and match capabilities to streamline your workflow. This is the second support for the analysis of dynamic analysis results after CAPE.

2. Support for BinExport files generated by Ghidra: BinExport files store disassembled data into a Protocol Buffer format. capa now supports the analysis of BinExport files generated by Ghidra. Using Ghidra and the BinExport file format users can now analyze ARM (AARCH64) ELF files targeting Android.

3. Introducing the capa rules website: You can now browse capa's default rule set at https://mandiant.github.io/capa/rules. In modern terminals the CLI capa tool hyperlinks to resources on the web, including entries on the capa rules website. Furthermore, https://mandiant.github.io/capa provides a landing page for the capa tool project.

### v7.2.0 (2024-08-20)

capa v7.2.0 introduces a first version of capa Explorer Web: a web-based user interface to inspect capa results using your browser. capa Explorer Web was worked on by @s-ff as part of a GSoC project, and it is available at https://mandiant.github.io/capa/explorer/. This release also adds a feature extractor for output from the DRAKVUF sandbox. Now, analysts can pass the resulting drakmon.log file to capa and extract capabilities from the artifacts captured by the sandbox.

New features:

- webui: explore capa analysis results in a web-based UI online and offline
- support analyzing DRAKVUF traces
- IDA extractor: extract names from dynamically resolved APIs stored in renamed global variables
- cli: add the ability to select which specific functions or processes to analyze

## Integrates with Popular Reverse Engineering Tools

capa uses the results of static or dynamic analysis to find the capabilities of programs. The tool can rely on many different analysis backends, including IDA, Ghidra, Binary Ninja, CAPE, DRAKVUF, and VMRay. The capa Explorer plugins provide interfaces for understanding the behaviors in programs, directly within reverse engineering tools.

### IDA Pro

Use the capa Explorer IDA Plugin to guide your reverse engineering, zeroing in on the interesting functions by behavior.

### Ghidra

Invoke Ghidra in headless mode to collect features for capa, or use the capa Explorer Ghidra plugin to understand key functions.

### Binary Ninja

Use Binary Ninja as the disassembler backend, relying on its state-of-the-art code analysis to recover capabilities.

### CAPE

Analyze the API trace captured by CAPE as it detonates malware, summarizing the behaviors seen across thousands of function calls.

# Download capa

We distribute capa as a standalone executable and as a Python library.

The standalone executable comes ready-to-go with 890+ embedded rules. Use this when analyzing files from the terminal on Windows, Linux, and macOS. There's a quickstart guide here (PDF).

Download standalone

capa is already included with malware analysis distributions like FLARE-VM and REmnux.

The Python library makes it easy to integrate capa into other projects, like our plugins for IDA Pro and Ghidra. Follow the instructions here , which starts with installation it from PyPI like this:

    pip install flare-capa

Here's an example of using capa as a library to process many files in parallel.

## capa

The FLARE team's open-source tool to identify capabilities in executable files.

Rules
Examples
Download

Copyright 2024 Google LLC
Licensed under the Apache License, Version 2.0.