Extending Capa for Malicious Script Analysis

Malware analysis is essential for understanding the behaviour of malicious software. While tools like capa can identify capabilities in native executables, extending similar analysis to scripts such as Python, Bash, JavaScript and C# broadens its support beyond binaries.

Capa is an open-source malware analysis tool that identifies the capabilities of executable files, including PE, ELF, .NET module, shellcode and sandbox reports. It extracts low-level features from the input like API calls, strings and instruction sequence, matches them against the capa-rules and reports the detected behaviours in a structured format.

This talk is about my Google Summer of Code project with FLARE organization where I am integrating a new feature in the capa tool. Currently, capa supports the analysis of the executable files and sandbox reports. My work extends capa to support analysis of scripting languages such as Python, Bash, JavaScript and C# using Tree-Sitter library. Tree-Sitter is an open source parser generator library which builds concrete syntax trees of the source file to extract language-specific features.

The talk will begin with a brief introduction of my journey into open source and Google Summer of Code. I will then explain capa's architecture and capability analysis workflow, followed by the design and implementation of the Tree-sitter integration. The session will cover the architectural decisions behind the implementation and how Tree-sitter enables capability extraction from scripting languages.

The talk will conclude with a live demonstration of capa's binary analysis along with the newly added script analysis support. By the end of the session, attendees will understand capa's architecture, its analysis workflow and the benefits of extending it with scripting language support.

1. Understand how capa identifies the capabilities of malware.
2. Learn how Tree-sitter enables analysis of scripting languages in capa.
3. Explore the architecture of capa and integration of the Tree-sitter library.
4. See a live demonstration of binary and script analysis in capa.