CapaGap — demo.exe — Multi-run capability coverage

All findings and evidence are shown. Enable JavaScript for filtering, copying, and export..matrix-group[hidden]{display:table-row-group!important}.details-row[hidden]{display:table-row!important}.js-only,.row-toggle{display:none!important}.print-only{display:inline!important}

Expand evidence Capability Namespace State baseline50%2 / 4 interactive50%2 / 4 ATT&CK Priority

inject shellcode into remote processload-code/inject/process load-code/inject/process Never observed Missing Missing T1055 high 69

Static evidence (2 locations)

Static evidence
VA / location	RVA	Copy
`0x404000`	`0x4000`
`0x404100`	`0x4100`

Image base0x400000

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at 0x404000

0x404000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: kernel32.WriteProcessMemory
  0x404010 · 0x404000
- Not matchedstring: synthetic alternative, not matched

Match at 0x404100

0x404100

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: kernel32.WriteProcessMemory
  0x404110 · 0x404100
- Not matchedstring: synthetic alternative, not matched

ATT&CK: T1055
MBC: E1055

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: None
Missing from: baseline, interactive

Suggested follow-up

Capture child-process memory and break on the supporting allocation/write/thread APIs near the static match.

Priority and context

Scores set investigation order, not severity or probability.

not observed in any of 2 dynamic runs
process-injection capability
mapped to MITRE ATT&CK
mapped to MBC
matched at 2 static locations
rule supports dynamic thread scope
the run also observed an anti-analysis capability

create scheduled taskpersistence/scheduled-task persistence/scheduled-task Some runs Missing Observed T1053.005 high 67

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x405000`	`0x5000`

Image base0x400000

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at 0x405000

0x405000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: taskschd.ITaskService.Connect
  0x405010 · 0x405000
- Not matchedstring: synthetic alternative, not matched

Runtime evidence (1 run)

interactive evidence (1 location)

interactive evidence
Location	Address type	Copy
`ppid:4/pid:1001/tid:2000`	`thread`

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at ppid:4/pid:1001/tid:2000

demo.exe · ppid:4/pid:1001/tid:2000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: taskschd.ITaskService.Connect
  ppid:4/pid:1001/tid:2000/call:1 · demo.exe · ppid:4/pid:1001/tid:2000 · Connect(synthetic arguments)
- Not matchedstring: synthetic alternative, not matched

ATT&CK: T1053.005
MBC: C0044

Static scope: function
Dynamic scope: process

Observation by run

Observed in: interactive
Missing from: baseline

Suggested follow-up

Repeat with the required privilege and longer runtime; inspect registry, service, task, and startup artifacts.

Priority and context

Scores set investigation order, not severity or probability.

observed in 1/2 runs; environment or stimuli changed coverage
persistence capability
mapped to MITRE ATT&CK
mapped to MBC
rule supports dynamic process scope
the run also observed an anti-analysis capability

check for sandbox process namesanti-analysis/anti-vm/vm-detection anti-analysis/anti-vm/vm-detection Some runs Observed Missing T1497.001 high 57

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x403000`	`0x3000`

Image base0x400000

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at 0x403000

0x403000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: kernel32.Process32FirstW
  0x403010 · 0x403000
- Not matchedstring: synthetic alternative, not matched

Runtime evidence (1 run)

baseline evidence (1 location)

baseline evidence
Location	Address type	Copy
`ppid:4/pid:1001/tid:2000`	`thread`

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at ppid:4/pid:1001/tid:2000

demo.exe · ppid:4/pid:1001/tid:2000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: kernel32.Process32FirstW
  ppid:4/pid:1001/tid:2000/call:1 · demo.exe · ppid:4/pid:1001/tid:2000 · Process32FirstW(synthetic arguments)
- Not matchedstring: synthetic alternative, not matched

ATT&CK: T1497.001
MBC: B0009

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: baseline
Missing from: interactive

Suggested follow-up

Inspect the static match site and debug the decision branch; repeat in a differently fingerprinted environment.

Priority and context

Scores set investigation order, not severity or probability.

observed in 1/2 runs; environment or stimuli changed coverage
anti-analysis capability
mapped to MITRE ATT&CK
mapped to MBC
rule supports dynamic thread scope

communicate over HTTPcommunication/http communication/http All runs Observed Observed T1071.001 info

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x402000`	`0x2000`

Image base0x400000

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at 0x402000

0x402000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: wininet.HttpSendRequestA
  0x402010 · 0x402000
- Not matchedstring: synthetic alternative, not matched

Runtime evidence (2 runs)

baseline evidence (1 location)

baseline evidence
Location	Address type	Copy
`ppid:4/pid:1000/tid:2000`	`thread`

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at ppid:4/pid:1000/tid:2000

demo.exe · ppid:4/pid:1000/tid:2000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: wininet.HttpSendRequestA
  ppid:4/pid:1000/tid:2000/call:1 · demo.exe · ppid:4/pid:1000/tid:2000 · HttpSendRequestA(synthetic arguments)
- Not matchedstring: synthetic alternative, not matched

interactive evidence (1 location)

interactive evidence
Location	Address type	Copy
`ppid:4/pid:1000/tid:2000`	`thread`

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at ppid:4/pid:1000/tid:2000

demo.exe · ppid:4/pid:1000/tid:2000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: wininet.HttpSendRequestA
  ppid:4/pid:1000/tid:2000/call:1 · demo.exe · ppid:4/pid:1000/tid:2000 · HttpSendRequestA(synthetic arguments)
- Not matchedstring: synthetic alternative, not matched

ATT&CK: T1071.001
MBC: C0002

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: baseline, interactive
Missing from: None

Observation

This capability was observed in every supplied dynamic result.

Priority and context

Scores set investigation order, not severity or probability.

observed in all 2 dynamic runs

capture screenshotcollection/screenshot collection/screenshot Runtime-only Missing Observed T1113 info

interactive evidence (1 location)

interactive evidence
Location	Address type	Copy
`ppid:4/pid:1002/tid:2000`	`thread`

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at ppid:4/pid:1002/tid:2000

demo.exe · ppid:4/pid:1002/tid:2000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: gdi32.BitBlt
  ppid:4/pid:1002/tid:2000/call:1 · demo.exe · ppid:4/pid:1002/tid:2000 · BitBlt(synthetic arguments)
- Not matchedstring: synthetic alternative, not matched

ATT&CK: T1113
MBC: Not mapped

Static scope: function
Dynamic scope: thread

Observation by run

Observed in: interactive
Missing from: baseline

Runtime observation

This capability appears only in dynamic results. Runtime resolution, unpacking, or extractor differences may explain the additional match.

execute shell commandload-code/execute load-code/execute Runtime-only Observed Missing T1059.003 info

baseline evidence (1 location)

baseline evidence
Location	Address type	Copy
`ppid:4/pid:1002/tid:2000`	`thread`

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at ppid:4/pid:1002/tid:2000

demo.exe · ppid:4/pid:1002/tid:2000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: kernel32.CreateProcessW
  ppid:4/pid:1002/tid:2000/call:1 · demo.exe · ppid:4/pid:1002/tid:2000 · CreateProcessW(synthetic arguments)
- Not matchedstring: synthetic alternative, not matched

ATT&CK: T1059.003
MBC: Not mapped

Static scope: function
Dynamic scope: process

Observation by run

Observed in: baseline
Missing from: interactive

Runtime observation

This capability appears only in dynamic results. Runtime resolution, unpacking, or extractor differences may explain the additional match.

encrypt data using AESdata-manipulation/encryption/aes data-manipulation/encryption/aes Static-only Not comparable Not comparable — info

Static evidence (1 location)

Static evidence
VA / location	RVA	Copy
`0x406000`	`0x6000`

Image base0x400000

Matched features and rule logic

Branch states describe capa rule evaluation, not whether code executed.

Match at 0x406000

0x406000

Matchedor
Synthetic alternatives for inspecting rule evidence
- Matchedapi: advapi32.CryptEncrypt
  0x406010 · 0x406000
- Not matchedstring: synthetic alternative, not matched

ATT&CK: Not mapped
MBC: C0027

Static scope: function
Dynamic scope: Not supported

Coverage boundary

This capability is excluded from the coverage denominator. The rule does not declare a supported dynamic scope.

Run contributions

Unique means observed in this run and no other supplied run. Baseline: baseline.

Run contributions
Run	Observed	Unique	Unique capabilities	Added vs baseline
baseline	2	1	check for sandbox process names	None
interactive	2	1	create scheduled task	create scheduled task

Representative set

baseline, interactive

A deterministic greedy selection preserving the measured capability union; not a guaranteed minimum. Equivalent capability coverage does not establish equivalent behavior. Runs with no unique capabilities cannot necessarily all be removed together.

Run conditions

Declared inputs relative to baseline baseline. A changed setting does not establish causation.

Run coverage and conditions
Run	Coverage	Runtime-only	Input confidence	Declared conditions	Changed vs baseline
baseline	50% (2/4)	1	high	`interaction=off`	None
interactive	50% (2/4)	1	high	`interaction=on`	interaction

Evidence hotspots

Findings at the same exact RVA. These are not inferred function boundaries or call-graph relationships.

Evidence hotspots
RVA	Findings	Max priority	Capabilities
`0x4000`	1	69	inject shellcode into remote process
`0x4100`	1	69	inject shellcode into remote process
`0x5000`	1	67	create scheduled task
`0x3000`	1	57	check for sandbox process names

Input details

High input confidence describes consistency between the supplied documents. It is not a confidence score for a behavioral conclusion.

Static

SHA-256aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Report: examples\evidence\static.json
Sample: demo.exe
capa version: 9.4.0
Extractor: VivisectFeatureExtractor
Result SHA-256: 6c38ace9f117747a9447a542d652032b9c98d1409fa715b636b8982ac8eb2f73
Analyzed at: 2026-08-29T20:00:00Z
Invocation: capa demo.exe -j
Platform: windows / amd64 / pe

baseline

SHA-256aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Report: examples\evidence\dynamic.json
Sample: cape-report.json
capa version: 9.4.0
Extractor: CapeExtractor
Result SHA-256: 1902bc08c68e640d246aa109affb89c7ec638634aa0aee13335fcfdc7d18987e
Analyzed at: 2026-08-29T20:05:00Z
Invocation: capa cape-report.json -j
Platform: windows / amd64 / pe

interactive

SHA-256aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Report: examples\evidence\dynamic-interactive.json
Sample: interactive-cape-report.json
capa version: 9.4.0
Extractor: CapeExtractor
Result SHA-256: 777a893495557f4316f918bd52ceb665b50826070d2f18306af37f437dd114f8
Analyzed at: 2026-08-29T20:15:00Z
Invocation: capa interactive-cape-report.json -j
Platform: windows / amd64 / pe

No ruleset manifest supplied.

Input diagnostics

No input-quality issues found.

Anti-analysis context

baseline: check for sandbox process names

These observed matches add a small priority boost to other gaps. They do not establish that any check caused the missing behavior.

Static evidence (2 locations)

Suggested follow-up

Static evidence (1 location)

interactive evidence (1 location)

Suggested follow-up

Static evidence (1 location)

baseline evidence (1 location)

Suggested follow-up

Static evidence (1 location)

baseline evidence (1 location)

interactive evidence (1 location)

Observation

interactive evidence (1 location)

Runtime observation

baseline evidence (1 location)

Runtime observation

Static evidence (1 location)

Coverage boundary

No comparable capabilities

Static

baseline

interactive

Copy text

Multi-run capability coverage

Evidence for inject shellcode into remote process

Static evidence (2 locations)

Suggested follow-up

Evidence for create scheduled task

Static evidence (1 location)

interactive evidence (1 location)

Suggested follow-up

Evidence for check for sandbox process names

Static evidence (1 location)

baseline evidence (1 location)

Suggested follow-up

Evidence for communicate over HTTP

Static evidence (1 location)

baseline evidence (1 location)

interactive evidence (1 location)

Observation

Evidence for capture screenshot

interactive evidence (1 location)

Runtime observation

Evidence for execute shell command

baseline evidence (1 location)

Runtime observation

Evidence for encrypt data using AES

Static evidence (1 location)

Coverage boundary

No comparable capabilities

Run contributions

Run conditions

Evidence hotspots

Input details

Static

baseline

interactive

Input diagnostics

Anti-analysis context