mirror of
https://github.com/mandiant/capa.git
synced 2025-12-12 15:49:46 -08:00
19
README.md
19
README.md
@@ -1,4 +1,16 @@
|
||||

|
||||
<br />
|
||||
<div align="center">
|
||||
<a href="https://mandiant.github.io/capa/" target="_blank">
|
||||
<img src="https://github.com/mandiant/capa/blob/master/.github/logo.png">
|
||||
</a>
|
||||
<p align="center">
|
||||
<a href="https://mandiant.github.io/capa/" target="_blank">Website</a>
|
||||
|
|
||||
<a href="https://github.com/mandiant/capa/releases/latest" target="_blank">Download</a>
|
||||
|
|
||||
<a href="https://mandiant.github.io/capa/explorer/" target="_blank">Web Interface</a>
|
||||
</p>
|
||||
<div align="center">
|
||||
|
||||
[](https://pypi.org/project/flare-capa)
|
||||
[](https://github.com/mandiant/capa/releases)
|
||||
@@ -7,6 +19,11 @@
|
||||
[](https://github.com/mandiant/capa/releases)
|
||||
[](LICENSE.txt)
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
---
|
||||
|
||||
capa detects capabilities in executable files.
|
||||
You run it against a PE, ELF, .NET module, shellcode file, or a sandbox report and it tells you what it thinks the program can do.
|
||||
For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.
|
||||
|
||||
Reference in New Issue
Block a user