capa: See What a Suspicious Executable Can Do, Without Running It (GitHub, Scanned)

capa answers the first question anyone asks about an unknown executable: what can this thing do? Run it against a Windows PE, a Linux ELF, a .NET module or raw shellcode and it disassembles the file and matches it against more than a thousand community-written rules, then prints a table of capabilities such as create a service, encode data with XOR, send HTTP requests or execute shell commands, together with the MITRE ATT&CK techniques and Malware Behavior Catalog entries they map to. It works statically, so the sample is never executed, and it can also read sandbox reports from CAPE, DRAKVUF and VMRay to describe what a program did at run time.

It is made by the FLARE team at Mandiant, now part of Google Cloud, and has been developed in the open since 2020: about 6,300 stars, 93 contributors, more than 6,300 commits and a 10.0.0 release in October 2026. It is Apache-2.0 licensed. Standalone binaries for Windows, macOS and Linux need no install, the flare-capa package is on PyPI for use as a library, and there are plugins for IDA Pro, Ghidra and Binary Ninja plus capa Explorer Web, a browser viewer for its JSON results.

• Repository: github.com/mandiant/capa
• Licence: Apache-2.0 (Apache License 2.0)
• Language: Python. Stars: 6,278. Forks: 743. Last push: Oct 25, 2026.
• Scan: safe, Oct 28, 2026, commit 2bdf7a4

Who it is for

Malware analysts and incident responders triaging suspicious files, SOC teams deciding which samples deserve a full reverse-engineering effort, students learning malware analysis, and researchers who want capability summaries for large sample sets.

Getting started

1. Download the standalone binary for your system from the releases page and unzip it

open https://github.com/mandiant/capa/releases/latest

2. Run it against a suspicious file (the standalone build includes the default rules)

./capa suspicious.exe

3. Or install the library with pip and point it at a capa-rules release

pip install flare-capa && capa -r capa-rules-10.0.0/ suspicious.exe

4. Show every matching rule and where it matched, or write JSON for capa Explorer Web

capa -vv suspicious.exe; capa -j suspicious.exe > results.json

capa never runs the sample, but you are still handling live malware: analyse files in an isolated VM, keep them in password-protected archives, and do not open them on a machine you care about. The pip install does not include rules; download a matching capa-rules release or the tool has nothing to match against.

Safety scan

We cloned mandiant/capa at commit 2bdf7a4 on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no install hooks and no committed binaries across 370 files and about 100,000 lines. The three pattern hits are very long lines with ordinary explanations: capa/render/proto/capa_pb2.py and capa/features/extractors/binexport2/binexport2_pb2.py are protobuf files generated by protoc, each holding a serialised schema on one line, and capa/ida/plugin/icon.py is the project's PNG logo as a base64 string, embedded so the IDA plugin has an icon without extra packaging.
• 11 known advisories, none critical and 3 high. Two of the highs are in web/explorer/package-lock.json, both dev dependencies of the Explorer Web build: cross-spawn through ESLint and vite through Vitest. Neither reaches the published web page or the Python tool.
• The third high is msgpack 1.2.1, pinned in requirements.txt, the file used to build the standalone binary. It comes in through vivisect, the disassembler backend, which uses it for saved .viv workspace files, so it does ship in the binary. The advisory is a memory leak, and capa ignores existing .viv workspaces unless you set an environment variable to allow them, so analysing a sample does not touch it. The pip package itself does not pin it.
• Eleven workflows. One uses pull_request_target, to check that a PR updates the changelog and leave a review; it never checks out or runs the PR's code and passes the PR body through an environment variable. All 8 third-party actions are pinned to commits. Releases are built in CI with PyInstaller, and pip-audit runs on the Python dependencies.
• The hosted capa Explorer Web and the project website load Umami, a cookieless analytics script; the command-line tool sends nothing, and Explorer Web reads result files in your browser rather than uploading them. Dependabot, CodeQL, licence and contributing guide present; no SECURITY.md in the repository. Scorecard 6.5.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 82.6K, JSON 5,451, Markdown 4,288, YAML 3,275, Vue 1,851, JavaScript 1,555.

Questions

Is capa free?

Yes. capa is Apache-2.0 licensed and free for any use, commercial included, and so are the capa-rules. The standalone binaries, the PyPI package, the disassembler plugins and capa Explorer Web all cost nothing.

Is it safe and legal to analyse malware with capa?

capa only reads the file, it never executes it, which makes it one of the safer first steps. The risk is in handling the sample itself, so work in an isolated virtual machine and keep samples zipped with a password. Analysing malware for defence and research is legal in most places; spreading samples or using what you learn against systems you do not own is not.

Does capa replace an antivirus or a sandbox?

No. capa does not decide whether a file is malicious; it tells you what the code is capable of so you can decide what to look at next. Packed or heavily obfuscated samples can hide most of their capabilities until they are unpacked, so pair it with a sandbox, YARA rules or a disassembler for anything that matters.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.