capa overview — capability findings for authorized samples

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

capa (mandiant/capa) applies capability rules to executables (and some supported analysis inputs) so analysts can see likely behaviors — network, persistence-ish host interaction, anti-analysis heuristics, and more — as a prioritized report. Version v10.0.0 is Apache-2.0. Use it on malware corpora you may hold, CTF binaries, or builds you own.

On this page

Snapshot

FieldValue
LicenseApache-2.0
PlatformsWindows, macOS, Linux (standalone releases upstream)
Latest checkedv10.0.0 (2026-10-16 UTC release notes)
JobCapability-oriented static findings
Cash cost$0

Where it sits in a lab stack

  1. Identify the file (DiE, hashes).
  2. capa for capability hypotheses on authorized PE/ELF.
  3. YARA for org-specific or family pattern packs (YARA legal start).
  4. Ghidra/Cutter/IDA/BN to verify the interesting matches.

Practical orientation

  • Download standalone binaries only from official GitHub Releases.
  • Read render/JSON output formats in current docs — flags evolve.
  • Treat nursery/experimental rules as noisier than mature ones.
  • Pin capa version + rule commit in every report.
Which to pick
  • Great second look after triage, before deep decompilation time sinks.
  • Not a substitute for dynamic analysis when behavior only appears at runtime (pair carefully, still authorized-only).
  • Not a cracking aid and not a malware builder.

Capability labels can sound dramatic. They do not create permission to keep, share or “detonate” samples outside your policy. BinBench does not host malware or capa result dumps of third-party proprietary software.

For legal, authorized and educational use only.

FAQ

What does capa output?

Human- and machine-readable reports of capability-oriented rule matches (for example file/network/anti-analysis behaviors) inferred from static features — hypotheses to verify, not courtroom verdicts.

Which version is cited?

v10.0.0 (GitHub release notes around 2026-10-16 UTC; docs site notes 2026-10-14). Re-check Releases before pinning CI.

Is capa a replacement for YARA?

No. YARA is a general pattern engine. capa ships capability-oriented rules and extractors aimed at executable analysis workflows.

Any v10 security note worth knowing?

Release notes describe a change around loading crafted .viv vivisect workspaces (pickle). Follow upstream: only opt into trusted .viv loading when documented.

Can I run capa on pirated software?

No. Authorized samples and educational labs only.

Sources