suggest to run on dynamic trace for packed samples (#852)

* suggest to run on dynamic trace for packed samples --------- Co-authored-by: Willi Ballenthin <[email protected]>
mandiant · Nov 28, 2023 · 5a0d4df · 5a0d4df
1 parent 305adfd
commit 5a0d4df
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/internal/limitation/file/internal-packer-file-limitation.yml b/internal/limitation/file/internal-packer-file-limitation.yml
@@ -8,8 +8,9 @@ rule:
       This sample appears to be packed.
 
       Packed samples have often been obfuscated to hide their logic.
-      capa cannot handle obfuscation well. This means the results may be misleading or incomplete.
+      capa cannot handle obfuscation well using static analysis. This means the results may be misleading or incomplete.
       If possible, you should try to unpack this input file before analyzing it with capa.
+      Alternatively, run the sample in a supported sandbox and invoke capa against the report to obtain dynamic analysis results.
     scopes:
       static: file
       dynamic: file