Malcat capa integration detects capabilities missed by standalone capa

[as0ni]

Description

I recently analyzed some Cobalt Strike shellcode (VT Link)
in Malcat, and its capa integration correctly identified several capabilities. However, running the standalone capa.exe with the same shellcode sample did not detect any capabilities.

Steps to Reproduce

1. I loaded the shellcode into Malcat (I understand you may not have access to this product).
2. I ran Malcat's capa integration to analyze the shellcode. This produced the following output:

3. I ran the standalone capa.exe command: capa.exe -r C:\Tools\capa-rules -f sc64 scwow.bin
   **Note: ** I used capa.exe version 7.40 and the latest rules from GitHub.

Expected behavior:
The standalone capa.exe should identify the same capabilities as Malcat’s capa integration.

Actual behavior:
The standalone capa.exe returned no capabilities found.

Versions

Malcat: Appears to use capa 4.0.1.
Standalone capa.exe: Version 7.40. I also downloaded and tested capa.exe version 4.0.1 to see if the issue was specific to newer versions, but it also identified no capabilities.
Capa Rules: Cross-checked rules like reference-http-user-agent-string.yml and resolve-function-by-parsing-pe-exports.yml between Malcat and the up-to-date versions on GitHub, with no identified significant differences.

All of this testing was done on a Windows 10 Enterprise VM.

If any additional screenshots or details are needed, please let me know. Thank you!

[williballenthin]

thanks for the detailed report @as0ni!

this sort of issue is usually due to malcat recovering more code than our built in framework can. especially with shellcode, where calls are often indirect, vivisect often has trouble finding all the functions. then capa isn't able to find the capabilities you see.

i can take a look at the sample you provided and confirm this behavior. there might be some things we can do to more aggressively recover code.

[as0ni]

Thanks for the quick feedback, @williballenthin! That makes a lot of sense. This lines up with what I'm seeing in Ghidra; initially, capa finds no capabilities in this shellcode. However, once I manually define a function, capa identifies access PEB ldr_data. It still doesn’t pick up the additional two rules that Malcat does, but as you mentioned, this likely stems from differences in how each framework recovers code. Appreciate you looking into this!