(RE) Capa

capa detects capabilities in executable files. You run it against a PE, ELF, .NET module, or shellcode file and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.

Download

GitHub - mandiant/capa: The FLARE team's open-source tool to identify capabilities in executable files.GitHub