CAPE
Malware sandbox for executing malicious files in an isolated environment with advanced features.
Malware sandbox for executing malicious files in an isolated environment with advanced features.
Checked October 2026.
CAPE is a malware sandbox used to execute malicious files in an isolated environment, instrument their dynamic behavior, and collect forensic artifacts. It features behavioral instrumentation, file capture, network traffic capture, malware classification, screenshots, memory dumps, automated unpacking, YARA signature-based classification, configuration extraction, debugger automation, anti-sandbox countermeasures, instruction traces, and an interactive desktop. A free demonstration instance is available online for anyone to use.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about CAPE: features, pricing and alternatives.
CAPE is a product in the Malware Analysis category. It covers File Analysis and Sandbox.
CAPE is free. Download and setup instructions are at https://github.com/kevoreilly/CAPEv2/.
Alternatives to CAPE listed on CybersecTools:
Compare all CAPE alternatives at https://cybersectools.com/alternatives/cape
CAPE is available as cloud or on-premises (hybrid). It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
An open source machine code decompiler that converts binary executables into readable C source code across multiple architectures and file formats.
Proprietary sandbox for enterprise malware & payload behavioral analysis.
CAPA is a static analysis tool that detects and reports capabilities in executable files across multiple formats, mapping findings to MITRE ATT&CK tactics and techniques.
A disassembly framework with support for multiple hardware architectures and clean API.
CapTipper is a python tool to analyze, explore, and revive HTTP malicious traffic.
CFGScanDroid is a Java utility that compares control flow graph signatures to Android method control flow graphs for malicious application detection.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
