Alternatives to capa
Identify likely capabilities inside executable files. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
capa
Identify likely capabilities inside executable files.
Replacements
Listings that take over the same core job as capa.
pestudio
A Windows tool for quick static assessment of executable files that highlights suspicious indicators.
pestudio is a Windows-only static triage tool that flags suspicious indicators in executables, with a freemium closed-source model instead of capa's open rule-based approach.
Detect It Easy
A program that identifies file types, packers, compilers and protectors used in executables.
Detect It Easy identifies file types, packers, compilers and protectors rather than capabilities, running on Windows, Linux and macOS with signature databases and YARA rules.
Similar software
Related functionality, not a direct replacement.
YARA
Pattern-matching engine for identifying and classifying malware samples.
YARA-X
Match files against rules describing suspicious binary patterns.
Ghidra
The NSA's reverse engineering framework, with a decompiler that turns machine code back into readable C.
PE-bear
A multiplatform viewer and editor for reversing Windows Portable Executable (PE) files.
FLARE-VM
Installation scripts that turn a Windows virtual machine into a malware analysis and reverse-engineering workstation.
radare2
Command-line reverse engineering framework and binary analysis toolkit.
