{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/kevoreilly/CAPEv2/blob/38c34af1aaeda512ea21ee834d19818a08a85d08/LICENSE",
    "https://github.com/kevoreilly/CAPEv2/tree/38c34af1aaeda512ea21ee834d19818a08a85d08/analyzer/windows/bin",
    "https://github.com/kevoreilly/CAPEv2/tree/38c34af1aaeda512ea21ee834d19818a08a85d08/analyzer/windows/dll",
    "https://github.com/kevoreilly/CAPEv2/blob/38c34af1aaeda512ea21ee834d19818a08a85d08/.gitmodules",
    "https://github.com/kevoreilly/CAPEv2/blob/38c34af1aaeda512ea21ee834d19818a08a85d08/pyproject.toml",
    "https://github.com/kevoreilly/CAPEv2/blob/38c34af1aaeda512ea21ee834d19818a08a85d08/changelog.md",
    "https://github.com/kevoreilly/CAPEv2/blob/38c34af1aaeda512ea21ee834d19818a08a85d08/.github/workflows/python-package.yml",
    "https://github.com/kevoreilly/CAPEv2/blob/38c34af1aaeda512ea21ee834d19818a08a85d08/.github/workflows/python-package-windows.yml",
    "https://github.com/kevoreilly/capemon/blob/b22d3d6d84bccd3c3d5eb933c5f5ea7fa60f1240/README.md"
  ],
  "category": "dynamic-analysis",
  "description_en": "Malware sandbox derived from Cuckoo v1 that runs samples in isolated Windows guests and records API-hook behavior, created and modified files, network traffic as PCAP, screenshots and memory dumps. Its capemon monitor adds automated unpacking, capturing injected, extracted or decompressed payloads and dumping process images, plus a debugger that YARA signatures or submission options can program with breakpoints and short instruction traces. Results are classified with YARA, Suricata and behavioral signatures, and malware configurations are extracted by parsers maintained in the separate CAPE-parsers package.",
  "description_zh": "源自 Cuckoo v1 的恶意软件沙箱，在隔离的 Windows 客户机中运行样本，记录 API 挂钩行为、创建和修改的文件、PCAP 网络流量、屏幕截图和内存转储。其 capemon 监控组件增加了自动脱壳功能，可捕获被注入、解出或解压的载荷并转储进程映像；内置调试器可由 YARA 签名或提交选项设置断点并输出简短的指令跟踪。结果通过 YARA、Suricata 和行为签名分类，恶意软件配置则由独立的 CAPE-parsers 包中的解析器提取。",
  "entry_url": "https://awesomerea.org/resources/capev2/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/capev2/",
  "evidence_url": "https://github.com/kevoreilly/CAPEv2/blob/38c34af1aaeda512ea21ee834d19818a08a85d08/README.md",
  "group": "tools",
  "id": "capev2",
  "json_url": "https://awesomerea.org/resources/capev2/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/capev2/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/capev2/index.md",
  "name": "CAPE Sandbox (CAPEv2)",
  "name_zh": "CAPEv2 恶意软件沙箱",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "There are no releases or tags: the reviewed master commit of 2026-10-18 is a rolling snapshot, with changes recorded in changelog.md, and pyproject.toml carries the placeholder version 0.1.0. The README recommends an Ubuntu 24.04 LTS host with KVM and Python 3.10 or 3.12, and Windows 10 or Windows 11 23H2 guests running agent.py under 32-bit Python 3.7.2 or 3.8. The kvm-qemu.sh and cape2.sh installers must be edited before use, only the rooter component runs as root, and the README asks users to read every file in conf/.",
    "Users supply the samples and their own Windows guest VMs; the repository ships no guest operating system. The Windows analyzer bundles helper binaries: the capemon.dll and capemon_x64.dll monitors and the loader.exe and loader_x64.exe loaders, built from the separate GPL-3.0 capemon repository; PPLinject and version.dll helpers whose source the reviewed files do not identify; and third-party tools under their publishers' own terms, namely Sysinternals PsExec, signtool.exe from the Windows SDK and the AutoIt3 interpreter.",
    "CI runs ruff, the pytest suites for the core, web interface and Linux analyzer, and mypy on Ubuntu 22.04 with Python 3.10 after a recursive checkout, plus pytest for the Windows analyzer on Windows. These check the framework's code, not detection or unpacking quality, and the README warns that configuration parsers can break as malware families change. A recursive clone also fetches the CAPE-TestFiles unit-test submodule, which includes a malware folder.",
    "LICENSE applies GPL-3.0 under a Cuckoo Foundation notice, which GitHub reports as NOASSERTION; the bundled Microsoft and AutoIt executables are not covered by it. Analysis executes malicious files, which the README places in an isolated environment."
  ],
  "requirements_zh": [
    "项目没有发布版本或标签：所审阅的 2026-10-18 master 提交是滚动快照，变更记录在 changelog.md 中，pyproject.toml 中的版本号 0.1.0 只是占位。README 建议使用 Ubuntu 24.04 LTS 宿主机、KVM 以及 Python 3.10 或 3.12，客户机为 Windows 10 或 Windows 11 23H2，并在其中用 32 位 Python 3.7.2 或 3.8 运行 agent.py。kvm-qemu.sh 与 cape2.sh 安装脚本需先修改再使用，只有 rooter 组件以 root 运行，README 还要求用户通读 conf/ 中的所有文件。",
    "样本和 Windows 客户虚拟机由使用者自备；仓库不提供客户机操作系统。Windows 分析组件附带若干辅助二进制：capemon.dll 与 capemon_x64.dll 监控组件以及 loader.exe 与 loader_x64.exe 加载器，由独立的 GPL-3.0 capemon 仓库构建；PPLinject 和 version.dll 辅助程序，所审文件未说明其源码出处；以及受各自发行方条款约束的第三方工具，即 Sysinternals PsExec、Windows SDK 中的 signtool.exe 和 AutoIt3 解释器。",
    "CI 在递归检出后于 Ubuntu 22.04 和 Python 3.10 上运行 ruff、核心、Web 界面与 Linux 分析组件的 pytest 测试套件以及 mypy，并在 Windows 上运行 Windows 分析组件的 pytest 测试。这些测试检查框架代码，并不衡量检测或脱壳效果；README 也提醒，配置解析器可能因恶意软件家族变化而失效。递归克隆还会拉取 CAPE-TestFiles 单元测试子模块，其中包含一个恶意软件目录。",
    "LICENSE 在 Cuckoo Foundation 声明下采用 GPL-3.0，GitHub 将其识别为 NOASSERTION；随附的 Microsoft 与 AutoIt 可执行文件不受该许可证覆盖。分析过程会执行恶意文件，README 说明应在隔离环境中进行。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/kevoreilly/CAPEv2",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}