CapaGap — demo.exe — Static and dynamic capability coverage

All findings and evidence are shown. Enable JavaScript for filtering, copying, and export..matrix-group[hidden]{display:table-row-group!important}.details-row[hidden]{display:table-row!important}.js-only,.row-toggle{display:none!important}.print-only{display:inline!important}

Expand evidence Capability Namespace State dynamic50%2 / 4 ATT&CK Priority

inject shellcode into remote processload-code/inject/process load-code/inject/process Unobserved Missing T1055 high 69

Static evidence (2 locations)

Static evidence
VA / location	RVA	Copy
`0x404000`	`0x4000`
`0x404100`	`0x4100`

Image base0x400000

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at 0x404000

0x404000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: kernel32.WriteProcessMemory
  0x404010 · 0x404000
- Not matchedstring: synthetic alternative, not matched

Match at 0x404100

0x404100

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: kernel32.WriteProcessMemory
  0x404110 · 0x404100
- Not matchedstring: synthetic alternative, not matched

ATT&CK: T1055
MBC: E1055

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: None
Missing from: dynamic

Suggested follow-up

Capture child-process memory and break on the supporting allocation/write/thread APIs near the static match.

Priority and context

Scores set investigation order, not severity or probability.

statically present but absent from this dynamic result
process-injection capability
mapped to MITRE ATT&CK
mapped to MBC
matched at 2 static locations
rule supports dynamic thread scope
the run also observed an anti-analysis capability

create scheduled taskpersistence/scheduled-task persistence/scheduled-task Unobserved Missing T1053.005 high 61

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x405000`	`0x5000`

Image base0x400000

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at 0x405000

0x405000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: taskschd.ITaskService.Connect
  0x405010 · 0x405000
- Not matchedstring: synthetic alternative, not matched

ATT&CK: T1053.005
MBC: C0044

Static scope: function
Dynamic scope: process

Observation by run

Observed in: None
Missing from: dynamic

Suggested follow-up

Repeat with the required privilege and longer runtime; inspect registry, service, task, and startup artifacts.

Priority and context

Scores set investigation order, not severity or probability.

statically present but absent from this dynamic result
persistence capability
mapped to MITRE ATT&CK
mapped to MBC
rule supports dynamic process scope
the run also observed an anti-analysis capability

check for sandbox process namesanti-analysis/anti-vm/vm-detection anti-analysis/anti-vm/vm-detection Observed Observed T1497.001 info

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x403000`	`0x3000`

Image base0x400000

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at 0x403000

0x403000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: kernel32.Process32FirstW
  0x403010 · 0x403000
- Not matchedstring: synthetic alternative, not matched

Runtime evidence (1 run)

dynamic evidence (1 location)

dynamic evidence
Location	Address type	Copy
`ppid:4/pid:1001/tid:2000`	`thread`

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at ppid:4/pid:1001/tid:2000

demo.exe · ppid:4/pid:1001/tid:2000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: kernel32.Process32FirstW
  ppid:4/pid:1001/tid:2000/call:1 · demo.exe · ppid:4/pid:1001/tid:2000 · Process32FirstW(synthetic arguments)
- Not matchedstring: synthetic alternative, not matched

ATT&CK: T1497.001
MBC: B0009

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: dynamic
Missing from: None

Observation

This capability was observed in every supplied dynamic result.

communicate over HTTPcommunication/http communication/http Observed Observed T1071.001 info

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x402000`	`0x2000`

Image base0x400000

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at 0x402000

0x402000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: wininet.HttpSendRequestA
  0x402010 · 0x402000
- Not matchedstring: synthetic alternative, not matched

Runtime evidence (1 run)

dynamic evidence (1 location)

dynamic evidence
Location	Address type	Copy
`ppid:4/pid:1000/tid:2000`	`thread`

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at ppid:4/pid:1000/tid:2000

demo.exe · ppid:4/pid:1000/tid:2000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: wininet.HttpSendRequestA
  ppid:4/pid:1000/tid:2000/call:1 · demo.exe · ppid:4/pid:1000/tid:2000 · HttpSendRequestA(synthetic arguments)
- Not matchedstring: synthetic alternative, not matched

ATT&CK: T1071.001
MBC: C0002

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: dynamic
Missing from: None

Observation

This capability was observed in every supplied dynamic result.

execute shell commandload-code/execute load-code/execute Runtime-only Observed T1059.003 info

dynamic evidence (1 location)

dynamic evidence
Location	Address type	Copy
`ppid:4/pid:1002/tid:2000`	`thread`

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at ppid:4/pid:1002/tid:2000

demo.exe · ppid:4/pid:1002/tid:2000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: kernel32.CreateProcessW
  ppid:4/pid:1002/tid:2000/call:1 · demo.exe · ppid:4/pid:1002/tid:2000 · CreateProcessW(synthetic arguments)
- Not matchedstring: synthetic alternative, not matched

ATT&CK: T1059.003
MBC: Not mapped

Static scope: function
Dynamic scope: process

Observation by run

Observed in: dynamic
Missing from: None

Runtime observation

This capability appears only in dynamic results. Runtime resolution, unpacking, or extractor differences may explain the additional match.

encrypt data using AESdata-manipulation/encryption/aes data-manipulation/encryption/aes Static-only Not comparable — info

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x406000`	`0x6000`

Image base0x400000

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at 0x406000

0x406000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: advapi32.CryptEncrypt
  0x406010 · 0x406000
- Not matchedstring: synthetic alternative, not matched

ATT&CK: Not mapped
MBC: C0027

Static scope: function
Dynamic scope: Not supported

Coverage boundary

This capability is excluded from the coverage denominator. The rule does not declare a supported dynamic scope.

Run details

Coverage for the supplied dynamic result.

Run coverage and conditions
Run	Coverage	Runtime-only	Input confidence
dynamic	50% (2/4)	1	high

Evidence hotspots

Findings at the same exact RVA. These are not inferred function boundaries or call-graph relationships.

Evidence hotspots
RVA	Findings	Max priority	Capabilities
`0x4000`	1	69	inject shellcode into remote process
`0x4100`	1	69	inject shellcode into remote process
`0x5000`	1	61	create scheduled task

Input details

High input confidence describes consistency between the supplied documents. It is not a confidence score for a behavioral conclusion.

Static

SHA-256aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Report: examples\evidence\static.json
Sample: demo.exe
capa version: 9.4.0
Extractor: VivisectFeatureExtractor
Result SHA-256: 6c38ace9f117747a9447a542d652032b9c98d1409fa715b636b8982ac8eb2f73
Analyzed at: 2026-08-29T20:00:00Z
Invocation: capa demo.exe -j
Platform: windows / amd64 / pe

dynamic

SHA-256aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Report: examples\evidence\dynamic.json
Sample: cape-report.json
capa version: 9.4.0
Extractor: CapeExtractor
Result SHA-256: 1902bc08c68e640d246aa109affb89c7ec638634aa0aee13335fcfdc7d18987e
Analyzed at: 2026-08-29T20:05:00Z
Invocation: capa cape-report.json -j
Platform: windows / amd64 / pe

No ruleset manifest supplied.

Input diagnostics

No input-quality issues found.

Anti-analysis context

dynamic: check for sandbox process names

These observed matches add a small priority boost to other gaps. They do not establish that any check caused the missing behavior.

Static evidence (2 locations)

Suggested follow-up

Static evidence (1 location)

Suggested follow-up

Static evidence (1 location)

dynamic evidence (1 location)

Observation

Static evidence (1 location)

dynamic evidence (1 location)

Observation

dynamic evidence (1 location)

Runtime observation

Static evidence (1 location)

Coverage boundary

No comparable capabilities

Static

dynamic

Copy text

Static and dynamic capability coverage

Evidence for inject shellcode into remote process

Static evidence (2 locations)

Suggested follow-up

Evidence for create scheduled task

Static evidence (1 location)

Suggested follow-up

Evidence for check for sandbox process names

Static evidence (1 location)

dynamic evidence (1 location)

Observation

Evidence for communicate over HTTP

Static evidence (1 location)

dynamic evidence (1 location)

Observation

Evidence for execute shell command

dynamic evidence (1 location)

Runtime observation

Evidence for encrypt data using AES

Static evidence (1 location)

Coverage boundary

No comparable capabilities

Run details

Evidence hotspots

Input details

Static

dynamic

Input diagnostics

Anti-analysis context