# capa > Mandiant FLARE tool that reports what an executable can do by matching a YAML rule set against features extracted from PE, ELF and .NET files or 32/64-bit shellcode, such as API calls, imports, strings and constants. Matches are grouped into capability namespaces with ATT&CK and MBC tags, and verbose output shows the function or basic-block addresses and features behind each match, pointing analysts to code worth studying. It also reads CAPE, DRAKVUF and VMRay sandbox reports for dynamic features and can use vivisect, IDA Pro, Ghidra or Binary Ninja for analysis, with explorer plugins for IDA and Ghidra and a browser viewer for its JSON results. - Type: Tool - Targets: Binary - Category: Native analysis tools - Relationship: Foundation tool - Sources reviewed: 2026-10-19 - Added to the catalog: 2026-10-20 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/capa/index.md) ## Requirements & limits - Release at review: v10.0.0, published 2026-10-16, with standalone PyInstaller builds for Linux (x86_64, arm64 and a Python 3.13 variant), macOS (x86_64 and arm64) and Windows that run without installation; the reviewed master commit only syncs the rules submodule after that tag. The installation guide says the Linux build needs GLIBC 2.26+ and that macOS Gatekeeper must approve the binary on first run. The flare-capa PyPI package (10.0.0, Python 3.10+) does not include the default rules or library-identification signatures, which are passed with -r and -s. - Inputs are user-supplied PE, ELF or .NET modules, raw shellcode, CAPE, DRAKVUF or VMRay reports, BinExport2 files or saved capa feature files. The IDA Pro explorer needs IDA 7.4+ with Python 3.10+ (tested through IDA 9.0); the Ghidra backend and explorer script need Ghidra 12.0+ started through PyGhidra; the Binary Ninja backend uses a separately installed Binary Ninja. - The limitations guide states that packed or obfuscated programs, installers and packaged programs such as AutoIt give misleading or incomplete results, and that capabilities split across wrapper or child functions are not matched; capa warns when its rules detect packing or installers. Matches are rule-based indications of capability, not confirmed behavior. - Apache-2.0, as is the separate capa-rules repository. v10.0.0 fixes code execution through crafted vivisect .viv workspace files, which affected v9.4.0 and earlier; existing workspaces now load only with CAPA_LOAD_VIV_WORKSPACE=1. A recursive source clone also fetches the test-file submodule, which the installation guide warns contains many malware samples. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. ## More in Native binaries - [RetDec](https://awesomerea.org/resources/retdec/index.md) · Tool - [REDasm](https://awesomerea.org/resources/redasm/index.md) · Tool - [Lighthouse](https://awesomerea.org/resources/lighthouse/index.md) · Tool - [BinAbsInspector](https://awesomerea.org/resources/binabsinspector/index.md) · Tool - [VulHunt Community Edition](https://awesomerea.org/resources/vulhunt/index.md) · Tool - [BinSync](https://awesomerea.org/resources/binsync/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.