# (RE) Capa

capa detects capabilities in executable files. You run it against a PE, ELF, .NET module, or shellcode file and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2FthSqlkdBbhqRtLxGkq4T%2Fimage.png?alt=media&#x26;token=3bcc8a98-bb3e-4967-9505-b2de36d32cc1" alt=""><figcaption></figcaption></figure>

Download&#x20;

{% embed url="https://github.com/mandiant/capa" %}
