Install capa Executable File Analyzer on Ubuntu 24.04

The capa is a static analysis tool used to identify capabilities within executable files, particularly those related to malware. It analyzes an executable and detects functionalities by matching known patterns that indicate specific behaviors, such as process injection, network communication, or file system manipulation. This tutorial shows how to install capa executable file analyzer on Ubuntu 24.04.

Install capa

Get a version of the capa from the GitHub repository and assign it to a variable:

CAPA_VERSION=$(curl -s "https://api.github.com/repos/mandiant/capa/releases/latest" | grep -Po '"tag_name": "v\K[0-9.]+')

Download the archive to the /usr/local/bin directory:

sudo wget -qO /usr/local/bin/capa.gz https://github.com/mandiant/capa/releases/latest/download/capa-v$CAPA_VERSION-linux.zip

Unpack the archive to get the executable:

sudo gunzip /usr/local/bin/capa.gz

Set executable permissions on the given file:

sudo chmod a+x /usr/local/bin/capa

Use this command to check the installed version of the capa:

capa --version

Testing capa

To use capa, simply run the command followed by the path of the executable you wish to analyze:

capa /usr/bin/mkdir

The command will scan the specified executable and output the capabilities it detects, such as file operations or system calls, providing insights into what the executable can do.

Uninstall capa

To uninstall capa, remove the corresponding file:

sudo rm -rf /usr/local/bin/capa