CapaGap — demo.exe — Static and dynamic capability coverage

All findings and evidence are shown. Enable JavaScript for filtering, copying, and export..matrix-group[hidden]{display:table-row-group!important}.details-row[hidden]{display:table-row!important}.js-only,.row-toggle{display:none!important}.print-only{display:inline!important}

Expand evidence Capability Namespace State dynamic50%2 / 4 ATT&CK Priority

inject shellcode into remote processload-code/inject/process load-code/inject/process Unobserved Missing T1055 high 69

Static evidence (2 locations)

Static evidence
VA / location	RVA	Copy
`0x404000`	`0x4000`
`0x404100`	`0x4100`

Image base0x400000

ATT&CK: T1055
MBC: E1055

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: None
Missing from: dynamic

Suggested follow-up

Capture child-process memory and break on the supporting allocation/write/thread APIs near the static match.

Priority and context

Scores set investigation order, not severity or probability.

statically present but absent from this dynamic result
process-injection capability
mapped to MITRE ATT&CK
mapped to MBC
matched at 2 static locations
rule supports dynamic thread scope
the run also observed an anti-analysis capability

create scheduled taskpersistence/scheduled-task persistence/scheduled-task Unobserved Missing T1053.005 high 61

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x405000`	`0x5000`

Image base0x400000

ATT&CK: T1053.005
MBC: C0044

Static scope: function
Dynamic scope: process

Observation by run

Observed in: None
Missing from: dynamic

Suggested follow-up

Repeat with the required privilege and longer runtime; inspect registry, service, task, and startup artifacts.

Priority and context

Scores set investigation order, not severity or probability.

statically present but absent from this dynamic result
persistence capability
mapped to MITRE ATT&CK
mapped to MBC
rule supports dynamic process scope
the run also observed an anti-analysis capability

check for sandbox process namesanti-analysis/anti-vm/vm-detection anti-analysis/anti-vm/vm-detection Observed Observed T1497.001 info

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x403000`	`0x3000`

Image base0x400000

ATT&CK: T1497.001
MBC: B0009

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: dynamic
Missing from: None

Observation

This capability was observed in every supplied dynamic result.

communicate over HTTPcommunication/http communication/http Observed Observed T1071.001 info

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x402000`	`0x2000`

Image base0x400000

ATT&CK: T1071.001
MBC: C0002

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: dynamic
Missing from: None

Observation

This capability was observed in every supplied dynamic result.

execute shell commandload-code/execute load-code/execute Runtime-only Observed T1059.003 info

dynamic evidence (1 location)

dynamic evidence
Location	Address type	Copy
`ppid:512/pid:1024`	`process`

ATT&CK: T1059.003
MBC: Not mapped

Static scope: function
Dynamic scope: process

Observation by run

Observed in: dynamic
Missing from: None

Runtime observation

This capability appears only in dynamic results. Runtime resolution, unpacking, or extractor differences may explain the additional match.

encrypt data using AESdata-manipulation/encryption/aes data-manipulation/encryption/aes Static-only Not comparable — info

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x406000`	`0x6000`

Image base0x400000

ATT&CK: Not mapped
MBC: C0027

Static scope: function
Dynamic scope: Not supported

Coverage boundary

This capability is excluded from the coverage denominator. The rule does not declare a supported dynamic scope.

Run details

Coverage for the supplied dynamic result.

Run coverage and conditions
Run	Coverage	Runtime-only	Input confidence
dynamic	50% (2/4)	1	high

Evidence hotspots

Findings at the same exact RVA. These are not inferred function boundaries or call-graph relationships.

Evidence hotspots
RVA	Findings	Max priority	Capabilities
`0x4000`	1	69	inject shellcode into remote process
`0x4100`	1	69	inject shellcode into remote process
`0x5000`	1	61	create scheduled task

Input details

High input confidence describes consistency between the supplied documents. It is not a confidence score for a behavioral conclusion.

Static

SHA-256aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Report: examples\static.json
Sample: demo.exe
capa version: 9.4.0
Extractor: VivisectFeatureExtractor
Platform: windows / amd64 / pe

dynamic

SHA-256aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Report: examples\dynamic.json
Sample: cape-report.json
capa version: 9.4.0
Extractor: CapeExtractor
Platform: windows / amd64 / pe

No ruleset manifest supplied.

Anti-analysis context

dynamic: check for sandbox process names

These observed matches add a small priority boost to other gaps. They do not establish that any check caused the missing behavior.

Static evidence (2 locations)

Suggested follow-up

Static evidence (1 location)

Suggested follow-up

Static evidence (1 location)

Observation

Static evidence (1 location)

Observation

dynamic evidence (1 location)

Runtime observation

Static evidence (1 location)

Coverage boundary

No comparable capabilities

Static

dynamic

Copy text

Static and dynamic capability coverage

Evidence for inject shellcode into remote process

Static evidence (2 locations)

Suggested follow-up

Evidence for create scheduled task

Static evidence (1 location)

Suggested follow-up

Evidence for check for sandbox process names

Static evidence (1 location)

Observation

Evidence for communicate over HTTP

Static evidence (1 location)

Observation

Evidence for execute shell command

dynamic evidence (1 location)

Runtime observation

Evidence for encrypt data using AES

Static evidence (1 location)

Coverage boundary

No comparable capabilities

Static

dynamic