# Capa Capability Categories Reference

## Overview

Capa organizes capabilities into namespaces that describe what a program can do. This reference covers the major categories and their significance in malware analysis.

## Anti-Analysis

Capabilities related to detecting or evading analysis tools and environments.

### anti-analysis/anti-debugging
- Detect debugger via API (IsDebuggerPresent, NtQueryInformationProcess)
- Detect debugger via PEB flags
- Timing-based anti-debug (rdtsc, GetTickCount)
- Exception-based anti-debug (INT 2D, INT 3)

### anti-analysis/anti-vm
- Detect virtual machine via CPUID
- Check for VM artifacts (registry, files, processes)
- Detect hypervisor via hardware checks
- Check MAC address for VM vendor prefixes

### anti-analysis/anti-disassembly
- Use opaque predicates
- Jump into middle of instruction
- Self-modifying code

### anti-analysis/packer
- Packed with UPX
- Packed with ASPack
- Packed with Themida
- Custom packer detected

**Analysis significance**: Presence of anti-analysis capabilities indicates the author is trying to evade detection. Multiple anti-analysis techniques suggest a sophisticated threat.

## Communication

Network communication capabilities.

### communication/http
- Send HTTP request (WinHTTP, WinINet, or raw socket)
- Receive HTTP response
- HTTP POST data
- Download file via HTTP
- Custom User-Agent string

### communication/socket
- Create TCP/UDP socket
- Connect to remote host
- Send/receive data over socket
- Listen for incoming connections

### communication/dns
- DNS resolution
- DNS TXT record query (potential C2)
- Custom DNS communication

### communication/named-pipe
- Create named pipe
- Connect to named pipe
- Read/write named pipe

### communication/ftp
- FTP file upload/download
- FTP authentication

### communication/smtp
- Send email (potential exfiltration or spam)
- SMTP authentication

**Analysis significance**: Communication capabilities reveal C2 channels and data exfiltration methods. HTTP POST and custom protocols are common C2 indicators.

## Collection

Data collection and theft capabilities.

### collection/keylog
- Log keystrokes (SetWindowsHookEx, GetAsyncKeyState)
- Monitor keyboard input

### collection/screenshot
- Capture screen (BitBlt, GDI)
- Record screen

### collection/clipboard
- Read clipboard data
- Monitor clipboard changes

### collection/file-managers
- Access browser credentials
- Access email client data
- Access FTP client credentials
- Access cryptocurrency wallets

### collection/webcam
- Access camera device
- Capture webcam image/video

### collection/microphone
- Access microphone
- Record audio

**Analysis significance**: Collection capabilities define the malware's intelligence-gathering objectives. Browser credential theft + keylogging strongly indicates an information stealer.

## Data Manipulation

Data transformation capabilities.

### data-manipulation/encryption
- AES encryption/decryption
- RC4 encryption/decryption
- XOR encryption
- RSA encryption
- Custom encryption algorithm

### data-manipulation/encoding
- Base64 encode/decode
- URL encoding
- Custom encoding scheme

### data-manipulation/hashing
- MD5 hashing
- SHA-1/SHA-256 hashing
- CRC32 computation
- API hashing (for dynamic resolution)

**Analysis significance**: Encryption in combination with file operations may indicate ransomware. Hashing combined with API resolution suggests evasion techniques.

## Executable

Characteristics of the executable itself.

### executable/packer
- Packed binary detected
- Known packer signature
- High entropy sections

### executable/installer
- Self-extracting archive
- Drop and execute payload
- Resource extraction

### executable/subfile
- Embedded PE file
- Embedded script
- Steganographic payload

**Analysis significance**: Packed or embedded executables often indicate multi-stage malware or droppers.

## Host Interaction

Interaction with the host operating system.

### host-interaction/file-system
- Create/delete/modify files
- Read file contents
- Search for files by extension
- Enumerate directory contents
- Get file attributes

### host-interaction/process
- Create new process
- Terminate process
- Enumerate running processes
- Get process information

### host-interaction/process/inject
- Classic DLL injection (CreateRemoteThread)
- Process hollowing (NtUnmapViewOfSection)
- APC injection
- Thread hijacking
- Atom bombing

### host-interaction/registry
- Read registry value
- Write registry value
- Delete registry key
- Enumerate registry keys

### host-interaction/service
- Create Windows service
- Start/stop service
- Modify service configuration

### host-interaction/os
- Get system information
- Get OS version
- Get computer name
- Get current user
- Check privileges

### host-interaction/network
- Get network adapter info
- Get IP configuration
- Enumerate network shares

### host-interaction/gui
- Create window
- Set window properties
- Message box display
- GUI-based user interaction

**Analysis significance**: Process injection is a strong indicator of malicious intent. Service creation combined with registry persistence suggests long-term access goals.

## Impact

Destructive or disruptive capabilities.

### impact/ransomware
- Encrypt files
- Delete shadow copies (vssadmin)
- Display ransom note
- Modify wallpaper

### impact/wiper
- Overwrite disk sectors
- Delete system files
- Corrupt boot records

### impact/dos
- Resource exhaustion
- Network flooding

**Analysis significance**: Impact capabilities indicate the malware's end goal. Ransomware indicators require immediate incident response.

## Persistence

Mechanisms for surviving system restarts.

### persistence/registry
- Registry Run key modification
- Registry RunOnce modification
- Winlogon modification
- Image File Execution Options

### persistence/scheduled-task
- Create scheduled task
- Modify existing task

### persistence/startup-folder
- Copy to startup folder

### persistence/boot
- Modify boot configuration
- Bootkit installation

**Analysis significance**: Persistence mechanisms indicate the attacker intends long-term access. Multiple persistence methods suggest redundancy planning.

## Capability Combinations and Malware Classification

| Combination | Likely Classification |
|-------------|----------------------|
| keylog + screenshot + credential theft + HTTP exfil | Information Stealer |
| file encryption + shadow copy deletion + ransom note | Ransomware |
| process injection + HTTP C2 + persistence | RAT / Backdoor |
| packed + anti-debug + dropper | Loader / Dropper |
| email sending + template processing | Spam Bot |
| DDoS + socket + command parsing | DDoS Bot |
| process injection + credential access + lateral movement | APT Implant |
| browser hook + form grabbing + HTTP intercept | Banking Trojan |
| file search + encryption + exfiltration | Data Theft Tool |
| USB propagation + file infection | Worm |