What it does
CAPE is a malware-analysis sandbox with dynamic behavior collection, unpacking and configuration-extraction capabilities.
CAPE extends a sandbox investigation beyond watching a process run. Its README describes payload unpacking, configuration extraction, network captures and memory artifacts alongside behavioral analysis. Operate it only in an appropriately isolated analysis environment with authorized samples and controlled network behavior. Preserve the configuration used for a run so results can be interpreted. CAPE has a distinct development history from Cuckoo; it is not a mirror or a pricing edition of the original project.
Strengths
- Behavioral artifacts and payload/configuration extraction
Best for
- Malware researchers maintaining an isolated analysis lab