- Home
- Malware Analysis Sandboxes
- CAPE Sandbox
CAPE Sandbox
What it is
CAPE Sandbox is a free, open-source malware analysis tool that runs suspicious files in isolated virtual machines and records behavior and forensic artifacts. It can capture execution activity, changed or created files, PCAP network traffic, screenshots and memory dumps. CAPE also performs dynamic unpacking, uses YARA to classify unpacked payloads, and extracts malware configurations through static and dynamic analysis. Its debugger can use YARA signatures for custom unpacking and configuration extraction, anti-sandbox countermeasures and instruction traces. Documented analysis targets include Windows executables, DLLs, PDFs, Office files, URLs, HTML, scripts, ZIP files and Java JARs. A Django web interface supports submissions, report browsing and searches; a REST API and Python functions support automated file and URL analysis. Deployment requires host and guest machines, and each analysis runs in a fresh virtual machine. GNU/Linux, preferably Ubuntu LTS, is the recommended host; Windows 10 or Windows 11 23H2 is the recommended guest. CAPE is self-hosted and distributed without warranty, and users are responsible for its use.
For and against
For
- Captures behavior, PCAP traffic, screenshots and memory dumps.
- Supports automated file and URL analysis.
- Includes YARA-based unpacking and classification tools.
- Free and open source.
Against
- Requires host and guest machines.
- Self-hosted setup is required.
- Distributed without warranty; use is the user's responsibility.
The verdict
CAPE Sandbox offers detailed dynamic analysis and automation for a self-hosted environment. Its setup requirements and lack of warranty are important considerations before deployment.
Who it suits
CAPE Sandbox suits users who need self-hosted, dynamic malware analysis and can provide host and guest machines. Its API and Python submission functions may suit teams automating file or URL analysis.
Plans and prices
Public demonstration instance
Free online demonstration · account activation via CAPE Sandbox social account
Read 15 Oct 2026 · github.com
CAPE Sandbox
Open-source software · self-hosted setup
Read 2 Oct 2026 · capev2.readthedocs.io
On the record
- AI clients
- The CAPE MCP server connects CAPE instances with MCP-compliant clients, with examples for Claude Desktop, Gemini CLI, and Antigravity.capev2.readthedocs.io · read 2 Oct 2026
- API authentication
- The API supports token authentication through the api-token-auth endpoint and Authorization headers.capev2.readthedocs.io · read 15 Oct 2026
- API throttling
- The documented default API throttle is five requests per minute and can be changed in api.conf.capev2.readthedocs.io · read 15 Oct 2026
- Architecture
- A Linux host manages isolated Windows guest virtual machines for each analysis.capev2.readthedocs.io · read 15 Oct 2026
- Automation
- CAPE offers a REST API and Python submission functions for automating file and URL analysis.capev2.readthedocs.io · read 2 Oct 2026
- Behavior monitoring
- Windows analysis uses API-hook instrumentation and behavioral signatures.capev2.readthedocs.io · read 15 Oct 2026
- Company origin
- The project history identifies Kevin O’Reilly at Context Information Security as the original CAPE developer.github.com · read 15 Oct 2026
- Configuration extraction
- Static and dynamic malware configuration extraction is built in, with optional RATDecoders, DC3-MWCP, MalDuck, and MaCo frameworks.github.com · read 15 Oct 2026
- Debugger
- The debugger supports YARA-triggered breakpoints, instruction traces, memory dumping, and control-flow changes to counter evasion.github.com · read 15 Oct 2026
- Deployment
- The documented architecture runs each analysis in a fresh isolated virtual machine; GNU/Linux, preferably Ubuntu LTS, is the recommended host, with Windows 10 or Windows 11 23H2 as the recommended guest.capev2.readthedocs.io · read 2 Oct 2026
- Distributed deployment
- Master and worker nodes can be distributed through a REST API on port 9003 with X-API-Token authentication.capev2.readthedocs.io · read 15 Oct 2026
- Documentation depth
- The documentation covers installation, guests, networking, cloud deployment, API usage, customization, distributed mode, and troubleshooting, while warning that some material may be outdated.capev2.readthedocs.io · read 15 Oct 2026
- Dynamic analysis
- It captures behavioral activity, files created or changed during execution, network traffic in PCAP format, screenshots, and memory dumps.capev2.readthedocs.io · read 2 Oct 2026
- Dynamic unpacking
- CAPE automatically extracts payloads from techniques including process injection, hollowing, doppelgänging, and in-memory decompression.github.com · read 15 Oct 2026
- File artifacts
- Analyses record files created, modified, or deleted during execution.capev2.readthedocs.io · read 15 Oct 2026
- Hypervisor extensibility
- Custom Python machinery modules can add unsupported virtualization backends; documented options include QEMU/KVM, LXC, Xen, OpenVZ, and VMware.capev2.readthedocs.io · read 15 Oct 2026
- Independent listing
- AlternativeTo describes CAPE as free and open source and reported no user comments or reviews on its listing.alternativeto.net · read 15 Oct 2026
- Input types
- Documented analysis targets include Windows executables, DLLs, PDFs, Office files, URLs, HTML, scripts, ZIP files, and Java JARs.capev2.readthedocs.io · read 2 Oct 2026
