Intro Reference: https://github.com/mandiant/capa Capa detects capabilities in executable files. It can be run against a PE, ELF, .NET module, or shellcode files and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies…