CapaGap — demo.exe — Multi-run capability coverage

All findings and evidence are shown. Enable JavaScript for filtering, copying, and export..matrix-group[hidden]{display:table-row-group!important}.details-row[hidden]{display:table-row!important}.js-only,.row-toggle{display:none!important}.print-only{display:inline!important}

Expand evidence Capability Namespace State baseline50%2 / 4 interactive50%2 / 4 ATT&CK Priority

inject shellcode into remote processload-code/inject/process load-code/inject/process Never observed Missing Missing T1055 high 69

Static evidence (2 locations)

Static evidence
VA / location	RVA	Copy
`0x404000`	`0x4000`
`0x404100`	`0x4100`

Image base0x400000

ATT&CK: T1055
MBC: E1055

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: None
Missing from: baseline, interactive

Suggested follow-up

Capture child-process memory and break on the supporting allocation/write/thread APIs near the static match.

Priority and context

Scores set investigation order, not severity or probability.

not observed in any of 2 dynamic runs
process-injection capability
mapped to MITRE ATT&CK
mapped to MBC
matched at 2 static locations
rule supports dynamic thread scope
the run also observed an anti-analysis capability

create scheduled taskpersistence/scheduled-task persistence/scheduled-task Some runs Missing Observed T1053.005 high 67

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x405000`	`0x5000`

Image base0x400000

ATT&CK: T1053.005
MBC: C0044

Static scope: function
Dynamic scope: process

Observation by run

Observed in: interactive
Missing from: baseline

Suggested follow-up

Repeat with the required privilege and longer runtime; inspect registry, service, task, and startup artifacts.

Priority and context

Scores set investigation order, not severity or probability.

observed in 1/2 runs; environment or stimuli changed coverage
persistence capability
mapped to MITRE ATT&CK
mapped to MBC
rule supports dynamic process scope
the run also observed an anti-analysis capability

check for sandbox process namesanti-analysis/anti-vm/vm-detection anti-analysis/anti-vm/vm-detection Some runs Observed Missing T1497.001 high 57

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x403000`	`0x3000`

Image base0x400000

ATT&CK: T1497.001
MBC: B0009

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: baseline
Missing from: interactive

Suggested follow-up

Inspect the static match site and debug the decision branch; repeat in a differently fingerprinted environment.

Priority and context

Scores set investigation order, not severity or probability.

observed in 1/2 runs; environment or stimuli changed coverage
anti-analysis capability
mapped to MITRE ATT&CK
mapped to MBC
rule supports dynamic thread scope

communicate over HTTPcommunication/http communication/http All runs Observed Observed T1071.001 info

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x402000`	`0x2000`

Image base0x400000

ATT&CK: T1071.001
MBC: C0002

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: baseline, interactive
Missing from: None

Observation

This capability was observed in every supplied dynamic result.

Priority and context

Scores set investigation order, not severity or probability.

observed in all 2 dynamic runs

capture screenshotcollection/screenshot collection/screenshot Runtime-only Missing Observed T1113 info

interactive evidence (1 location)

interactive evidence
Location	Address type	Copy
`ppid:512/pid:1024/tid:4096`	`thread`

ATT&CK: T1113
MBC: Not mapped

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: interactive
Missing from: baseline

Runtime observation

This capability appears only in dynamic results. Runtime resolution, unpacking, or extractor differences may explain the additional match.

execute shell commandload-code/execute load-code/execute Runtime-only Observed Missing T1059.003 info

baseline evidence (1 location)

baseline evidence
Location	Address type	Copy
`ppid:512/pid:1024`	`process`

ATT&CK: T1059.003
MBC: Not mapped

Static scope: function
Dynamic scope: process

Observation by run

Observed in: baseline
Missing from: interactive

Runtime observation

This capability appears only in dynamic results. Runtime resolution, unpacking, or extractor differences may explain the additional match.

encrypt data using AESdata-manipulation/encryption/aes data-manipulation/encryption/aes Static-only Not comparable Not comparable — info

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x406000`	`0x6000`

Image base0x400000

ATT&CK: Not mapped
MBC: C0027

Static scope: function
Dynamic scope: Not supported

Coverage boundary

This capability is excluded from the coverage denominator. The rule does not declare a supported dynamic scope.

Run conditions

Declared inputs relative to baseline baseline. A changed setting does not establish causation.

Run coverage and conditions
Run	Coverage	Runtime-only	Input confidence	Declared conditions	Changed vs baseline
baseline	50% (2/4)	1	high	`interaction=off`	None
interactive	50% (2/4)	1	high	`interaction=on`	interaction

Evidence hotspots

Findings at the same exact RVA. These are not inferred function boundaries or call-graph relationships.

Evidence hotspots
RVA	Findings	Max priority	Capabilities
`0x4000`	1	69	inject shellcode into remote process
`0x4100`	1	69	inject shellcode into remote process
`0x5000`	1	67	create scheduled task
`0x3000`	1	57	check for sandbox process names

Input details

High input confidence describes consistency between the supplied documents. It is not a confidence score for a behavioral conclusion.

Static

SHA-256aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Report: examples\static.json
Sample: demo.exe
capa version: 9.4.0
Extractor: VivisectFeatureExtractor
Platform: windows / amd64 / pe

baseline

SHA-256aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Report: examples\dynamic.json
Sample: cape-report.json
capa version: 9.4.0
Extractor: CapeExtractor
Platform: windows / amd64 / pe

interactive

SHA-256aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Report: examples\dynamic-interactive.json
Sample: interactive-cape-report.json
capa version: 9.4.0
Extractor: CapeExtractor
Platform: windows / amd64 / pe

No ruleset manifest supplied.

Anti-analysis context

baseline: check for sandbox process names

These observed matches add a small priority boost to other gaps. They do not establish that any check caused the missing behavior.

Static evidence (2 locations)

Suggested follow-up

Static evidence (1 location)

Suggested follow-up

Static evidence (1 location)

Suggested follow-up

Static evidence (1 location)

Observation

interactive evidence (1 location)

Runtime observation

baseline evidence (1 location)

Runtime observation

Static evidence (1 location)

Coverage boundary

No comparable capabilities

Static

baseline

interactive

Copy text

Multi-run capability coverage

Evidence for inject shellcode into remote process

Static evidence (2 locations)

Suggested follow-up

Evidence for create scheduled task

Static evidence (1 location)

Suggested follow-up

Evidence for check for sandbox process names

Static evidence (1 location)

Suggested follow-up

Evidence for communicate over HTTP

Static evidence (1 location)

Observation

Evidence for capture screenshot

interactive evidence (1 location)

Runtime observation

Evidence for execute shell command

baseline evidence (1 location)

Runtime observation

Evidence for encrypt data using AES

Static evidence (1 location)

Coverage boundary

No comparable capabilities

Static

baseline

interactive