InCyter v0.0.9

InCyter 0.0.9

A major update: a rebuilt Event Logs page with InCyter Intelligence, File & Hash and Malware Analysis working together, smarter InSentri setup, and more than 200 fixes and security hardening changes from a complete review of every part of InCyter.

---

Event Logs: InCyter Intelligence and a rebuilt Event Explorer

• The attack story. Findings that share an account, an address or a computer are linked into one story, in the order it happened, with each stage named. Where it likely started shows the earliest serious event, and Look at these first ranks accounts and computers by what was found about them.
• 16 new detections for what no single event shows: ransomware preparation, an account moving from computer to computer, signing in at two places at once, a new admin used straight away, account takeover, short-lived accounts and services, one password tried on many computers, the clock being changed, and more.
• About forty more logs read when analysing a PC: firewall, code integrity, file sharing, SSH, PowerShell 7, USB, disk images, Forwarded Events and more, with new checks for each. Every check was run over normal, working PCs first, so only what normal use does not do raises a finding.
• Logs from several computers at once, with one row per computer. Click a name to narrow the whole page to it.
• Review each finding: mark it Reviewed, False positive or Escalate, with a note. Reviews are remembered across analyses.
• A shorter, quicker page: the verdict and the findings first, everything else in one Details box. Similar findings are grouped, and you can group by attack stage, computer or account.
• Timeline and log coverage: see the events behind each finding on a timeline, and spot gaps where a log recorded nothing.
• Incident report: export the verdict, the story, every finding with its review and note, your bookmarked events and the timeline as one web page or PDF.
• A rebuilt Event Explorer:
  • Every event, with no row limit, and repeats folded.
  • Undo and Redo (Ctrl+Z / Ctrl+Y), and filter chips you can remove one by one.
  • Search words such as account:, ip:, id:, computer: and hour:, with suggestions as you type.
  • Every event explained in plain words.
  • Group by account, computer, event ID, program or source.
  • Select several events, compare two side by side, bookmark and export.
  • Account and computer profiles, a weekday-by-hour sign-in map, and your own working hours for out-of-hours activity.
• Save and reopen an investigation (Ctrl+S / Ctrl+O): bookmarks, notes, stages, filters and saved views come back exactly as you left them.
• What's missing: the logging worth switching on, most useful first, with how to turn it on.

File & Hash and Malware Analysis lead to each other

• File & Hash → Analyse offline opens the same file in Malware Analysis > File Analysis, worked out on your own computer.
• File Analysis → Check online offers the same file to the services File & Hash shows. Each one says what it sends: most send only the hash, and a sandbox uploads the file and asks first.

InSentri, the built-in AI assistant

• Guided setup: when you switch InSentri on, it now also offers GPU acceleration (when a supported graphics card is found) and large-document support, and starts any downloads for you.
• Waits until it is ready: while a model, GPU acceleration or large-document support is downloading or installing, InSentri shows each one with its progress and unlocks by itself when everything is done.
• GPU acceleration switches on by itself once it has installed.
• "InSentri is off" now offers to take you straight to its settings.
• Stop, Clear and file uploads work reliably, and downloaded models and GPU files are checked before they are used.

Major security and bug fixes

More than 200 fixes and security hardening changes. The most important:

• Safer updates: each update's size and SHA-256 fingerprint are checked against the published release before it installs, and an update that does not match is not run. New in Settings > About: choose whether InCyter checks for updates when it starts (on by default).
• Your keys and data stay private: API keys and passwords are kept out of InCyter's logs and out of what InSentri can read, and each key is only ever sent to the service it belongs to. Settings exports are protected with a passphrase, and imports show what will change before anything is applied.
• Safer handling of files and links: files, archives, documents and emails are handled more defensively, including oversized and deliberately malformed ones. Lookups that contact a domain's own servers now say so.
• Updated built-in components: Python 3.14.8 and OpenSSL 3.5.9, with the latest security fixes.
• Works on brand-new PCs: online features (vulnerability lists, news, update checks and more) now work on a freshly installed Windows PC.
• More accurate results, fewer false alarms:
  • Signed, legitimate programs no longer get warnings meant for malware, and verdicts say when a check could not be completed instead of reading clean.
  • Domain checks (DMARC, SPF, DKIM, MTA-STS) follow the published standards more closely.
  • Email authentication results are read correctly, and ordinary names are no longer mistaken for brand impersonation.
  • Event Logs counts duplicate logs once, keeps the newest events in big logs, and no longer raises common harmless activity as a finding.
• Fixes across the app:
  • Lookups show an honest status when a service cannot be reached.
  • Email Analyser handles Outlook .msg attachments, large emails and look-alike domains correctly.
  • PDF export, installing, upgrading and uninstalling are more reliable.
  • Popups open on the right monitor and fit small screens, scrolling follows the mouse, and the interface is tidier throughout.

The full list is in CHANGELOG.txt below, and in InCyter under Full changelog.

---

Installing and updating

• New install: download InCyterInstaller.exe below and run it. Everything InCyter needs is included; there is nothing else to install.
• Updating from an earlier version: use Check for updates in InCyter, or run the new installer over the old one. Your settings, API keys, history and InSentri models are kept.
• If you use GPU acceleration for InSentri: after updating, press Enable GPU acceleration once in Settings > InSentri. Until then InSentri runs on the CPU as normal.
• Windows may show "Windows protected your PC" the first time you run the installer, because it is not yet signed with a code-signing certificate. Click More info, then Run anyway.

InCyter v0.0.8

InCyter v0.0.8 - Major update to Malware Analysis

Malware Analysis now holds everything you need to examine a suspicious file, log or app: File Analysis, Event Logs, Store Apps, Encrypted Files, Fuzzy Hash and YARA Scanner.

The first time you open this version, a What's New window shows each headline with a screenshot of where to click. You can reopen it any time from Settings > About.

Event Logs (new)

Drop Windows event logs (.evtx), or click Analyse this PC. If you approve the administrator prompt, the Security log is included too.

• What needs attention, most serious first - password guessing and spraying (including spraying that succeeded), logons shaped like pass-the-hash, one account reaching many computers, failed and outgoing Remote Desktop connections, records deleted from the middle of a log
• Remote-access tools - AnyDesk, ScreenConnect, Atera, TeamViewer, RustDesk, ngrok and 19 more
• Abused drivers - 56 driver names known to be used to switch off security software, plus 24 known-vulnerable driver builds
• Sign-ins and sessions - who logged on, from where and for how long, in your local time (UTC with one click)
• Findings start folded, with Show / Find filters right above them. Exclude what you expect to see, and export findings to CSV or JSON
• Event Explorer - every record, searchable, with filters, a date calendar and presets. Click any account or address on the page to open everything about it

Store Apps (new)

Some apps only come from a store and can't be downloaded as a file. Paste an App Store, Microsoft Store or Google Play link, here or in the Home scan bar. InCyter shows:

• who publishes the app, how long it has been listed, its ratings and when it was last updated
• for Microsoft Store apps, what the app is allowed to do
• look-alike apps that use a famous name but come from a different publisher

This checks the store listing, not the app's code. To check the code, InCyter needs the app file.

Mac files (new)

Drop a .dmg, .pkg, Mac program, configuration profile, launch agent or AppleScript in File Analysis.

• Signatures are verified, not just read: the certificate chain is checked against Apple's root certificates, and the signature must match this exact code. A signature copied from another app fails
• Check with Apple asks Apple's own services whether the app is notarised and whether its certificate has been revoked. It sends only the code hash, and only when you click it
• Profiles show what they would change, such as a browser extension forced on you or Gatekeeper switched off
• Every Mac detection was reviewed against Apple's documentation and real installers, so ordinary installers (Docker, Office, MacTeX) are no longer flagged as risky

Android and iPhone apps (new)

Drop an .apk (or a split .xapk / .apks bundle) or an .ipa in File Analysis.

• permissions explained in plain words
• the permission patterns used by banking trojans and spyware
• who signed the app, and debug builds
• for iPhone apps, how the app is distributed (App Store, enterprise or ad hoc)

Help on every page (new)

Press Help on any page for a step-by-step guide. Each step is collapsed - click one for a few plain lines and a picture of where to click.

• Help opens at the tab or lens you're on (Help on Email > IOCs opens the IOCs step)
• The guide stays open beside the page while you work
• All 47 pages and tabs are covered, including some that had no help before

Also new

• OneNote notebooks (.one) - lists the files hidden inside and flags scripts and programs behind a "double-click to view" picture
• Faster on big files - large disk images and archives are read in parallel, and files on cloud drives are copied locally first. A 700 MB disk image went from 35 seconds to 6
• Home scan bar - drop a file on it or click Browse, and it opens in the right tool. Typing an IP, domain, URL, hash or CVE works as before
• Domain Tools > DMARC Reports - reads the reports that mail receivers send you, and tells you whether you're ready to enforce
• IOC export as STIX 2.1 or a MISP event
• Passive DNS takes an IP address - it lists the domains seen on it
• Popups open in place instead of flashing in the corner first, and tab bars wrap on narrow windows
• The navigation bar opens after you rest on it for a second, so you can click an icon without it sliding open
• Settings > Input History: remove single entries, and Clear asks before deleting

Fixed

• The progress bar on .dmg and .pkg files could get stuck at 1% or time out
• A memory dump (.dmp) could open on an empty Document lens instead of listing the programs inside it
• After opening a PDF, its blank pane stayed on screen under every other lens
• Older CVEs scored only with CVSS v2 showed no severity in Software Search and CVE Lookup
• Software Search matched words separately, mixing in unrelated CVEs - several words are now searched as a phrase
• Email IOCs listed the Message-ID as an email address
• IOC Extract reported Office template links (schemas.microsoft.com) as indicators
• YARA Scanner counted rule files in subfolders that a scan never reads
• The QR Code tab's hint text was cut off
• Outlook's address-book downloads were flagged as an unusual site
• Password-spraying counts stopped at 40
• Popups on a second monitor jumped to the main screen
• DMARC: "DKIM for Microsoft 365" contradicted itself behind a mail gateway

---

Installation: Run InCyterInstaller.exe - no Python required. Requires Windows 10/11 x64.

InCyter v0.0.7

InCyter v0.0.7 - What's New

This version is a fix release, driven by what people hit in v0.0.6

Three things people actually ran into: the 8B model would not finish downloading, exported PDFs looked nothing like the app, and "Draft with InSentri" refused to work on most tabs.

Model downloads no longer give up

The 8B model is 5.5 GB, pulled over four connections. If any one of them went quiet for 60 seconds, the whole download ended - and on a slow or busy line that is close to inevitable. The 2B is small enough to usually finish first, which is why only the 8B was reported.

There is now a retry per connection, with backoff. A stalled connection reconnects and carries on from where it stopped while the other three keep going.

Already on v0.0.6 and stuck? Press Download again. It resumes from where it stopped - that was always true, the app just never said so.

You can also set Download connections to 1 in Settings > InSentri > Advanced, which is steadier on an unreliable link. That setting existed but was never shown.

Model downloads are verified even offline

The expected checksum used to be fetched from Hugging Face at download time, so a network that blocks it got no integrity check at all - the model installed and ran, quietly marked unverified. The checksums now ship with InCyter, so a download is verified whether or not the internet cooperates, and a file that does not match is refused and deleted.

If your network blocks huggingface.co, you can place the .gguf in the models folder yourself and InCyter will use it:

• bartowski/ibm-granite_granite-3.3-2b-instruct-GGUF - ibm-granite_granite-3.3-2b-instruct-Q4_K_M.gguf
• bartowski/ibm-granite_granite-4.1-8b-GGUF - ibm-granite_granite-4.1-8b-Q4_K_M.gguf
• nomic-ai/nomic-embed-text-v1.5-GGUF - nomic-embed-text-v1.5.Q4_K_M.gguf

Exported reports

• PDFs now look like InCyter. They are printed through the browser engine already on Windows, so the PDF matches what Preview shows - dark theme, cards, badges, score bars. The old renderer stays as an automatic fallback, so the export never fails for want of a browser
• The analyst summary appears in DMARC reports. It was being written and then silently dropped for that one tab
• Text is readable. Several panels were rendering near-white on near-white - the text was always there, at the background's own colour
• The export dialog stays open. Exporting one format is usually followed by the other; closing meant retyping the analyst name and summary every time

Draft with InSentri works everywhere

It only ever worked on six tabs inside Malware Analysis. Everywhere else - DMARC, WHOIS, SSL Cert, Passive DNS, the Email Analyser tabs, CVE Lookup and the rest - it said "run an analysis first" with the analysis plainly on screen.

It also never loaded the model, so it did nothing unless you had already opened the chat that session to warm it up. It now drafts from any exportable tab, loading the model on demand, and says what went wrong when something does.

Navigation

Hovering the collapsed rail opened the nav with every entry shifted - Settings sat well above the gear it replaced, by 76 pixels at the bottom of the list. Both states now share one row height, so an item stays exactly where the pointer is aiming.

Fixed

• GPU acceleration downloaded in silence - no percentage, no sign it was alive. It now shows the file, the percentage and how long it has been running, including during the phases pip reports nothing for
• A stalled connection threw away a multi-gigabyte model download
• Model downloads were not verified at all when Hugging Face could not be reached
• The PDF was laid out nothing like the HTML - the PDF renderer has no flex or grid, so the report is now built with tables
• The print styling was being overruled by rules written below it in the stylesheet
• Draft with InSentri never loaded the model
• The analyst summary never reached the DMARC report
• Opening the nav moved every item out of line with its icon

---

Installation: Run InCyterInstaller.exe - no Python required. Requires Windows 10/11 x64.

InCyter v0.0.6

InCyter v0.0.6 - What's New

A release about finishing the job

v0.0.5 built File Analysis. v0.0.6 makes it a tab you can actually work a sample in.

InCyter used to report a fact and stop one step short of the answer it raises. It said "400 KB of high-entropy bytes appended after the last section" and gave you no way to look at them. It said "this is a .NET assembly" and told you to find a decompiler. That gap is what this release closes.

Archives: RAR, 7z, CAB, ISO, TAR, GZ, BZ2 and XZ

The Archive lens read ZIP properly, .7z shallowly, and everything else failed with "Invalid or corrupt ZIP file". A RAR carrying one malicious file among four innocent ones could not be opened at all.

Every format now gets the same analysis: per-entry SHA-256 and MD5, content classification, macro confirmation, lure detection, flags and scoring. A test packs the same five files as ZIP, 7z, RAR, solid RAR and TAR and requires all five analyses to come out identical. Which reader handles an archive is decided by content, so a .rar renamed .zip still opens.

Nothing is written to disk - members are streamed into memory and capped. Only "Scan Contents", which you click, writes a file out. A 60-file RAR lists, classifies and hashes every entry in 1.9 seconds.

Encrypted archives are handled in three states: contents encrypted, file list encrypted, or clear. Archives locked with the passwords malware distributors reuse - infected, virus, password, 1234 - open themselves, and hiding the file list is itself scored.

.NET assemblies are read as .NET

Roughly half of commodity malware is managed code - AsyncRAT, Quasar, njRAT and their forks. Everything the PE inspector said about such a sample described the CLR wrapper every .NET binary shares: "Imports" listed one entry, mscoree.dll, because the runtime resolves the rest at load time.

There is now a .NET Assembly section reading the CLI metadata directly:

• The name the assembly was compiled as, which survives renaming the file
• The MVID - a build-time GUID. Two files sharing one came out of a single compilation, however differently they are packed or named. No native equivalent exists
• P/Invoke declarations - the Win32 APIs managed code actually reaches for, which is the real import table of a .NET binary. Injection calls are named and scored
• Embedded resources with offsets, so a packer's payload can be carved in one click
• Every string literal, and obfuscator markers (ConfuserEx, .NET Reactor, SmartAssembly and the rest)

The MVID read was checked against the .NET runtime's own answer on six real assemblies and matches exactly.

Hidden payloads can be pulled out

Appended data, embedded executables and .NET resources each carry an Analyse button. The bytes re-enter the same Any File analysis, so a carved payload gets identity detection, hashes and YARA for free - and a payload inside a payload works too.

Going back restores the previous page rather than re-analysing it. Measured on a 40 MB sample: analysis 2.0s, Back 0.30s. On a 2 GB file that is the difference between instant and minutes.

Memory dumps

Malware very often exists in RAM in a form it never took on disk - unpacked, decrypted, injected. Minidumps and kernel dumps are now read, the images inside listed, and any of them carved out and analysed.

YARA rules, written and tested for you

InCyter generates a rule from a sample, then verifies it before you see it: compiled, run against the sample, and run against a corpus of known-good Windows binaries. If it matches something clean it is refined and tried again.

Also in File Analysis

• Two samples compared structurally - sections, imports, resources and .NET identity, with findings graded so a shared MVID does not carry the same weight as a shared icon
• A signed, legitimate build now says so up front, instead of leaving you to assemble that from six sections
• Every date in one place - compile, debug, signing and countersigning, with disagreements called out. The first version of this fired on 85% of signed Microsoft binaries; it now fires on 0% of a 220-binary corpus
• The header spent three lines saying one thing. File name, size and type now sit in the drop zone, which lightens when a file is loaded
• Carve buttons say what they are offering to analyse, instead of twenty identical "Analyse" buttons
• The Browse dialog has a file-type filter, which it had been missing entirely

The navigation gets out of the way

The left nav sat open permanently at 168 px, which is a lot of a laptop screen given how rarely you change tab. It now starts as a 54 px icon rail and opens on hover.

A pin in the top row makes it permanent: the page lays out beside the nav rather than under it, so nothing is covered.

InSentri

• Documents work properly. A PDF in Free chat is now actually seen, instead of being acknowledged and then denied. A document on "This page" no longer hides the page
• Summaries read the whole document rather than a handful of retrieved passages
• An image-only PDF says it has no readable text instead of quietly contributing nothing
• Conversation context is sized by what fits, not a fixed message count - why some chats seemed to forget what you had just discussed
• Stop works during a summary, measured at 1.04 seconds into an 11.3-second call
• Choosing Ollama and then closing it is no longer a dead end - the picker offers the built-in model in one click instead of a transport error
• CUDA picks the right card on a machine with more than one

Fixed

• .7z archives listed only ONE file, whatever they contained - the listing was split on the wrong line ending
• An archive with an encrypted file list would have hung the app, waiting on a console password prompt that never returns
• "Scan Contents" extracted the file and showed nothing - every format, ZIP included
• A correct password on an AES ZIP was refused. Python's own ZIP reader cannot decrypt AES at all, which is what modern tools produce by default
• An archive InCyter had just unlocked was then not analysed
• A damaged archive was presented as a healthy one, showing the entries it could recover as if they were all of them
• Pressing Back mid-analysis let the carved file paint over the parent page
• The collapsed nav highlighted the wrong tab, and the same scoping mistake was reaching history tagging and defanging
• A document summary stopped mid-word, and another came back as one word repeated two thousand times
• A failed analysis left the tab on "Loading..." for ever; it now says what went wrong
• Small, highly compressible files were denied a hash, inconsistently between formats
• A renamed .NET assembly and a repackaged one were reported as the same thing. They are not

Under the hood

Bundled tool licences now ship with the tools, in licenses\. A line-by-line audit of File Analysis was completed before release and found a real crash where two concurrent analyses fought over the same YARA rule file. The test suite stands at 24 automated suites, run before every build.

---

Installation: Run InCyterInstaller.exe - no Python required. Requires Windows 10/11 x64.

InCyter v0.0.5

InCyter v0.0.5 - What's New

A major update

The biggest release so far. Two new things lead it:

• InSentri - an AI assistant that runs entirely on your own machine
• InCyter Intelligence - InCyter's own verdict engine, now named and marked everywhere it speaks

Plus a rebuilt File Analysis, files identified by content instead of filename, and a new Script & LNK Analyser.

InSentri - a local AI analyst, built in (new)

Ask questions about whatever is on your screen. Explain this verdict. Summarise this page. Map it to MITRE ATT&CK. Draft the remediation. Compare this sample to the one I looked at earlier.

It runs on your machine. No cloud, no account, no data leaving your network unless you switch on web search yourself.

It is off until you want it. Nothing downloads, nothing loads, nothing runs until you enable it in Settings. Enabling it asks how you want it to run - a built-in model or your own Ollama server - then which model, with the size of each. Nothing is chosen for you and nothing is fetched until you say so.

It advises, it never overrules. Where InCyter has reached a verdict, InSentri explains it rather than replacing it.

Also worth knowing:

• Answers cite the section they came from, and clicking a citation jumps you there to check it
• Any hash, IP, domain or CVE in an answer is clickable: scan it in the right tab, or copy it defanged
• It docks into the window instead of floating, and can be popped out
• Chat history is encrypted locally, or can be switched off entirely
• A phishing email cannot talk it into anything: everything it reads is treated as evidence, never as instructions

InCyter Intelligence - InCyter's own verdicts, clearly marked

Every judgement InCyter makes now carries an "InCyter Intelligence" tag. It tells you the reasoning is InCyter's own, runs locally, and needs no internet.

Third-party results (raw YARA hits, VirusTotal figures) deliberately stay untagged, so the mark means something. Verdicts also show a "Why this score" breakdown listing each finding and what it added.

New under it: Capability Detection states what a file can actually do in plain English - "reads the clipboard", "takes screenshots", "creates a service" - each mapped to MITRE ATT&CK, instead of leaving you to infer intent from an import table.

GPU acceleration that checks before it commits

If you have an NVIDIA card, InSentri can run on it. InCyter now works out what your machine needs by itself: it reads the card, its memory, the driver version and what your processor supports, then fetches the build that matches. An older driver cannot run a newer CUDA release, so the right one is chosen rather than assumed.

It is checked before it is used. A GPU build that installs but will not actually run on your hardware is caught during setup and rolled back, so you are never left with an assistant that answers nothing. If it fails later anyway, InSentri drops back to CPU on its own and tells you why in plain English instead of a Windows error code.

Email Analyser - the headers, read properly

Technical Info now shows what the message headers were already telling you.

The delivery chain, with times. Each hop shows when it happened, how long it took, and whether that leg was encrypted, with the total transit time. Underneath, anything the timeline gives away: a hop stamped before the hop that handed to it (time cannot run backwards - that is a wrong clock or a forged header), a break where one hop does not line up with the next, a long unexplained stall, a leg that crossed unencrypted, and a Date that disagrees with when the first server actually saw the message.

Every domain the message claims. From, Reply-To, Return-Path and Message-ID side by side. A real phishing email tested against this asserts four different domains - each one was already a line in the indicators list, but seen together they are the whole story.

Who actually sent it. Where a message came through a mass-mailing platform (Drip, SendGrid, Mailchimp, Mailgun, Amazon SES and others) it is named, with the standard abuse address. Reporting the account behind it is faster than blocking a throwaway domain.

What the receiving mail system already decided. Microsoft stamps a spam confidence level on everything it delivers, and other gateways stamp their own verdict. InCyter never read any of it. Now it does - a second opinion you already had.

File Analysis - one drop zone instead of seven tabs

PE / MSI, ZIP and Office & PDF used to make you classify a file before InCyter had looked at it. Now there is one "Any File" drop zone: drop anything, InCyter works out what it is, and Metadata and Strings are there for the same file without dropping it again.

Files are identified by content, not by name

The extension is the one thing an attacker fully controls. InCyter now reads the file itself.

Drop an executable called "invoice.pdf" and it goes to the PE analyser, with a clear warning that the name disagrees with the contents. Double extensions and right-to-left override tricks are caught too, each mapped to its MITRE technique. Previously a mislabelled file went to the wrong analyser and simply failed.

No more freezing on huge files

A multi-gigabyte installer used to leave InCyter "Not Responding" for about a minute. There is still no size limit, but the work no longer blocks the window, progress is live, and Cancel actually stops it. A 2.3 GB file now takes about 16 seconds and stays responsive.

Script & LNK Analyser (new)

For the PowerShell one-liner from a Defender alert, or a suspicious shortcut. It peels layered obfuscation and shows every layer, so you see how the payload was hidden. A decoded layer that turns out to be an executable is extracted and sent to the PE analyser. Shortcuts are pulled apart properly, including the machine ID left behind by whoever built them. Nothing is ever executed.

Email Analyser - catches what text scanning misses

• QR codes in the body and attachments are decoded and treated as indicators. Quishing works precisely because the link is never text
• Phone numbers are picked out, for callback phishing that gives a number instead of a link
• Display-name impersonation, including homoglyph and mixed-script tricks
• Every link checked for the real host behind the visible text

Domain Tools - now opens on DMARC

• SPF Duplicate & Overlap Check finds addresses authorised twice through different includes, and names which providers they came from. SPF fails outright past 10 lookups, so this is a real outage risk
• DKIM Key Health replaces a badge that went green if any selector answered. It now flags weak keys under 2048-bit, revoked selectors and test-mode flags

Reports, redesigned

Exported HTML and PDF now read like the analysis page: section cards, verdict badges, InCyter's colours. Printing switches to a light layout. Reports can carry your own summary, and InSentri can draft it for you to edit.

Also new

• YARA works straight away. The engine now ships with InCyter and rules load automatically, instead of telling you to install something
• PE / MSI: collapsible sections, one-click fingerprint pivots (imphash, Rich header), and a proper signing-certificate view
• A one-time Terms screen on first launch, reopenable from Settings - About
• Model downloads use several connections at once, roughly halving the wait

Changed and removed

• "PE / MSI Inspector" is now "PE / MSI Analyser"; "Office & PDF" is now "Office & PDF Analyser"
• YARA Scanner moved out of File Analysis to sit beside Fuzzy Hash
• The Case feature in History has been removed. It tagged scans and filtered one list, but nothing else in InCyter used it. Existing history is untouched
• Uninstalling now removes InCyter's data folder, including anything InSentri downloaded

Fixed

• An executable named as a .pdf produced a parse error instead of an explanation
• Long text ran off the right edge in several File Analysis panels
• Switching to Metadata or Strings showed an empty panel until you re-dropped the file
• Tooltips ran off the screen instead of wrapping
• Pinning InCyter now keeps InSentri on top with it
• Dropping an email onto the "drag and drop" text did nothing; only the empty space around it worked
• InSentri could refuse a long email with a context error instead of answering it
• The download size shown for the larger model was 640 MB short of the real one
• Model and provider choices could look like every option was selected at once
• Settings could still offer to enable GPU acceleration after it had been installed

A full security review of the codebase was completed and every finding fixed.

---

Installation: Run InCyterInstaller.exe - no Python required. Requires Windows 10/11 x64.

InCyter v0.0.4

InCyter v0.0.4 - What's New

IP & ASN (new)

The IP scanner is now "IP & ASN". Enter an IP to see the network that owns it - ASN, organisation, country, registry, and CIDR prefix - or type an ASN (e.g. AS15169) to look up a whole network, with a link to every prefix it announces. Runs with no API key (Team Cymru over DNS + RDAP) and works behind firewalls. All the existing IP reputation lookups (VirusTotal, AbuseIPDB, GreyNoise, Shodan, ipinfo) are unchanged.

Extension Analyser (new)

New tab under Malware Analysis - File Analysis. Analyse a Chrome/Edge/Brave/Opera/Firefox extension for malicious behaviour without installing it: paste a store link or extension ID, or drop a .crx/.xpi/.zip file or unpacked folder. Scores permissions and host access, CSP relaxation, Manifest V2 vs V3, content-script scope, JavaScript red flags and packer obfuscation, and runs a YARA scan - plus best-effort store reputation. Tuned so legitimate-but-powerful extensions (ad blockers, password managers) don't cry wolf. Static analysis only - the extension is inspected, never run.

Safe Document Viewer (new)

A "View Document" button on the Office & PDF analyser lets you SEE a suspicious document safely inside InCyter, so you never open it in Adobe/Word.

• PDF: each page rendered as an image with navigation and zoom - embedded JavaScript, OpenAction and Launch actions are NOT executed
• Office (.docx/.xlsx/.pptx and macro-enabled): read-only preview of text, tables, images, and the VBA macro source - inspected, never run

Office & PDF - merged into one auto-detecting tab

"Office & Macro" and "PDF" are now a single "Office & PDF" tab. Drop or browse a file and InCyter detects the type and runs the right analyser automatically - Office documents to the macro/VBA analyser, PDFs to the PDF structure analyser. Detection is extension-first with a magic-byte fallback, so extensionless or mislabelled files still route correctly. Drop something that isn't a document and it points you to the right tab instead.

URL & Domain - merged into one auto-detecting tab

The separate "URL" and "Domain" scanners are now one "URL & Domain" tab. Type or paste an indicator and InCyter detects whether it's a full URL or a bare domain and points each service (VirusTotal, OTX, urlscan, ANY.RUN, etc.) at the correct endpoint. History is tagged with the right type automatically. The URL Shortener and filescan.io now work on bare domains too.

Email Analyser - forwarding awareness and attachments

• Forwarded mail is now understood. When SPF/DKIM/DMARC "fail" because a message was forwarded, InCyter explains why and shows the ORIGINAL sender's real authentication result from the ARC chain. If the original email is attached it can be re-analysed in one click; otherwise you can expand the ARC chain to see each hop. The verdict is never softened and content checks still run - a forwarded-but-malicious email is still flagged
• Attachments now have their own tab with a live count (e.g. "Attachments (2)"), each showing type/size, dangerous/double-extension/macro flags, SHA-256, and a "Send to Malware Analysis" button
• The sender domain is now read from the real address, so a spoof like "security@paypal.com" attacker@evil.ru is correctly treated as evil.ru
• Lookalike/impersonation check on the sender: flags punycode, mixed-script (homoglyph) and near-miss brand domains

Malware Analysis - deeper detection

• PE Inspector detects .NET/managed assemblies (shows the CLR version) and scans PE resources for embedded executables and high entropy
• Office & Macro detects Excel 4.0 (XLM) macros and VBA stomping; RTF files and embedded OLE objects are extracted, hashed, and routable to the right analyser
• ZIP Analyser shows each entry's own SHA-256/MD5, catches zip bombs spread across many mid-size entries (not just one huge file), and auto-tries common malware passwords (infected, virus, 1234, etc.) on encrypted archives before prompting

Domain Tools - stronger domain checks

• New combined "Domain Risk" verdict on WHOIS, blending domain age, registry/DNS status and live TLS posture, with the reasons listed
• New Typosquat/lookalike checker that generates typo variants of a domain and shows which are live
• SSL tab now performs a live TLS handshake to show the certificate the host actually serves (issuer, SANs, validity, self-signed/hostname-mismatch), alongside the crt.sh history

DMARC - SPF IP search and expandable DKIM

• New "Search IP" box on the SPF results: tells you if an IP is authorised, including membership of a range (e.g. "209.85.128.173 is inside 209.85.128.0/17") and which provider it belongs to
• DKIM selectors are now expandable, showing the key type/size, all record fields, the full public key, and the CNAME delegation so you can see which provider (SendGrid, Mailchimp, Mimecast, etc.) actually manages the key

ANY.RUN - analysis time and plan awareness

• New "Analysis time" setting (1 to 20 minutes) - the default sandbox run used to be only 60 seconds
• InCyter now detects your plan from the key, shows the exact environments your key can run, and warns before uploading a file that's over your plan's size limit

CVE - clearer priority

CVE Lookup now leads with a plain "ACT NOW / HIGH / MEDIUM / MONITOR" verdict that blends CVSS severity, EPSS exploitation probability and CISA KEV status. Software Search matches real CPE version ranges (fewer false hits), and MITRE ATT&CK search now also matches descriptions and lists clickable sub-techniques.

Toolkit - decoder, regex, JWT

• Obfuscation decoder peels layered encodings (e.g. base64 into gzip) and adds gzip, zlib, Base32, ROT-N and decimal-escape codecs
• Regex Tester shows capture groups per match and has a "Replace with" box
• JWT decoder shows the issued-at time and can verify HS256/384/512 signatures against a secret
• IOC Extract now also pulls IPv6 addresses and filters out benign document/namespace noise and private IPs

Investigation History - cases

• Group related scans into named cases and filter the history by case
• A "Re-open" button on every row jumps back into the originating tab with the IOC pre-filled and re-runs it
• The toolbar is split into filters and actions rows so nothing gets clipped

Home page - faster feed

The threat intelligence feed now shows articles as each source finishes loading (first results in well under a second) instead of staying blank, and it dims stories you've already opened so new items stand out.

Reputation lookups

Results are briefly cached (5 minutes) so repeating a lookup is instant and doesn't burn API quota; rate-limits are retried automatically; successful lookups are auto-logged to History; and Bulk Scan now corroborates IPs with AbuseIPDB and exports the filtered view.

Look and feel

• Every pop-up is now a consistent dark InCyter dialog centred on the window - no more stray white Windows message boxes
• The collapsed sidebar shows a clickable icon rail with a clean expand arrow

Security hardening

A full security audit was completed and every finding fixed - covering safer handling of malicious files (decompression bombs, crafted PDFs/Office/archives), stronger protection of your stored API keys, and guards against a poisoned config backup or feed. Nothing you need to configure; it's all under the hood.

Note - Password/Hash cracking moved to InCracker

Password and hash cracking is now a separate app, InCracker. InCyter's Encrypted Files analyser still tells you how crackable a file is and gives you the exact command to run.

Other improvements

• Fixed: File & Hash YARA scan said "No file loaded" after a file was loaded
• Fixed: PDF JavaScript hidden in indirect streams is now decoded; legacy .doc/.xls/.ppt metadata now reads correctly
• Fixed: IOC defanging no longer strips legitimate brackets/parentheses (IPv6 URLs survive)
• Fixed: VirusTotal verdict wording and colour now agree (Suspicious 1-4, Malicious 5+)
• Fixed: SSL tab no longer flags naturally-superseded old certificates as expired
• Fixed: Home page CVE quick-scan and clipboard "IOC detected" now land on CVE Lookup and search automatically
• Plain-text debug logs moved into a logs\ subfolder (auto-migrated); the log meant for bug reports is now redacted of any keys/tokens
• Project moved to github.com/FadyAzzi/InCyter (existing installs keep updating normally)

---

Installation: Run InCyterInstaller.exe - no Python required. Requires Windows 10/11 x64.

InCyter v0.0.3

InCyter v0.0.3 - What's New (MAJOR Update)

Malware Analysis - deeper detection across all four analysers

PE/MSI Inspector, ZIP Analyser, Office & Macro Analyser, and PDF Analyser all got a major detection upgrade: context-aware risk scoring that dampens false positives on signed/trusted software, optional YARA signature scanning with tiered scoring, and a consistent "why this verdict" panel (summary, legend, and rationale) so you can see exactly what triggered a risk score instead of an opaque badge.

• PE/MSI Inspector: YARA scanning, refined attack-capability detection (process injection/hollowing), Authenticode-aware scoring
• ZIP Analyser: YARA scanning on archive contents, lure-filename detection, nested-archive recursion limits
• Office & Macro Analyser: DDE field detection, embedded OLE object detection, remote template injection detection, safe static decoding of obfuscated VBA strings
• PDF Analyser: JavaScript decoding, embedded file extraction with a direct "Extract & Open" pivot into the right analyser, digital signature and Launch-action detection
• All four: file hashing, YARA match details, and a "Send to Bulk Scan" pivot for extracted IOCs

Email Analyser - rebuilt for real-world phishing detection

• Restructured into three tabs - Technical Info, Threat Analysis, IOCs - instead of nested sub-tabs
• Real email parsing: multipart, base64, and quoted-printable bodies now decode correctly. HTML-only emails (the majority of real phishing lures) are now actually analysed instead of showing an empty body
• Threat Analysis now factors in SPF/DKIM/DMARC authentication failures and detects link text/href mismatches (a link that displays one domain but points to another)
• IOCs tab now also catches link targets hidden behind generic text like "Click Here"
• Streamlined toolbar - IOCs populate automatically on Analyse, so the separate "Scan IOCs" button was removed

Bulk Scan - usable without a VirusTotal API key

New "Open in browser" control opens a batch of 5 or 10 IOCs' VirusTotal report pages directly in your browser - no API key required. The warning banner now only appears when actually relevant, scans that are cancelled mid-way no longer get stuck on "Pending...", and the Copy button in the IOCs list now works correctly.

Home Page - Live Threat Intelligence Feed

The home page now shows a live multi-source cybersecurity news feed. Sources: CISA KEV, ACSC (cyber.gov.au), BleepingComputer, The Hacker News, and Cyber Security News. Toggle each source on or off - preference saved between sessions. Refreshes once daily after 05:00 local time with manual refresh available.

Hash Cracker (new)

New sub-tab under Pass/Hash Crack for cracking MD5, SHA-1, SHA-256, SHA-512, SHA3-256, NTLM, and bcrypt hashes. Algorithm auto-detected from hash length/prefix. Supports Offline, Wordlist, and Mask Attack modes. Hashcat GPU integration with one-click download - no manual setup required. Imports file hashes directly from Password Cracker.

ZIP Analyser (new)

New tab under File Analysis. Lists all files in a ZIP with type, size, and risk flags. Detects executables, scripts, zip bombs, path traversal, double extensions, nested ZIPs, and polyglot files. Scan Contents extracts and opens any internal file in the correct analyser tab.

Password Cracker - additions

Mask Attack mode, Export Hash button for Hashcat-ready output, InCyter Repo browser for wordlists, Help button.

DMARC Analyser - SPF Tree View and IP Export

Tree View is now the default view, showing nested SPF includes with click-to-expand hierarchy and provider tags. The flat view is now called List View. New Export IPs button exports the full authorised IP list to CSV or PDF.

Export - HTML and PDF for all tabs

The Export button on every tab now offers HTML and PDF. Reports are structured with section headings, labelled rows, and colour-coded values - not a raw text dump.

Email Analyser - Drag and Drop

Drag emails directly from the Outlook desktop app, or drag .msg/.eml files from Explorer, straight onto the Email Analyser input.

Input History and Autocomplete

Every main search field now remembers previous inputs and suggests matches as you type. History is grouped by field type (Domain Tools, IP, Domain, URL, CVE, Software, Hash Cracker) and shared across related tabs. Up to 40 entries per category, saved across sessions.

Encrypted Files - Info Icons

Every row in the Encryption Details section now has a hover tooltip (i) with a plain-English explanation of that field - covering all formats including PGP/GPG, Age, Microsoft Purview, Office, PDF, ZIP, BitLocker, and OpenSSL.

Settings - Features - Granular Sub-tab Control

The Features page now shows all nested sub-tabs as individual toggles:

• File Analysis: PE/MSI Inspector, ZIP Analyser, Office & Macro, PDF, Metadata, YARA Scanner, Strings
• Pass/Hash Crack: Password Cracker, Hash Cracker
• IOC Extract & Defang: Text Extract, File/PCAP, Image/PDF OCR, QR Code, Regex Tester
• Encoder/Decoder: Decode & Encode, JWT
• Email Analyser: Technical Info, Threat Analysis, IOCs

Settings & Updates polish

The About page description now reflects the full current toolset. The automatic "What's New" popup no longer shows stale or mismatched release notes when running a build ahead of what's published. Release notes and changelogs now render with real formatting (headers, bold, bullet lists) instead of raw markdown text.

Other improvements

• PE/MSI Inspector: MSI/MSM/MSP support, Risk Verdict badge, Authenticode, PE anomalies, suspicious imports
• PDF Analyser: password-protected PDFs, Show Content section
• Office & Macro: document text viewer, collapsible VBA section, plain-English macro summary
• Metadata: password-protected Office and PDF files now supported
• History logging added for all tools (PE Inspector, YARA, Fuzzy Hash, Strings, Metadata, Office, PDF, ZIP, Password Cracker, Hash Cracker)
• Log retention: 30-day rolling retention for all log files
• Toolkit moved to Tools section in sidebar
• All help buttons documented and working
• New app icon, dark title bar on all dialogs

InCyter v0.0.2

InCyter — Change Summary

v0.0.2 — 2026-06-15

• Copy control added next to every result row across the entire application
(text was not previously selectable). It stays hidden until you hover the row,
then shows a subtle "Copy" link beside the value; clicking shows "✓ Copied".
Affects: DMARC results, WHOIS, SSL, PassiveDNS, Email Analyser, CVE/NVD,
file metadata, and API popup rows.

• Email Analyser — phishing body detection rebuilt as a weighted scoring engine.
Each phrase is STRONG (fires alone) or WEAK (needs two+), so a stray keyword in
a normal email no longer alarms while real phishing is still caught. Added smart
structural checks: invisible char inside a word, defanged URLs (example[.]com),
javascript:/data: links, and urgency-next-to-money (BEC fingerprint). Fixed the
Outlook-signature zero-width-space false positive. Results now show a plain
summary, per-category indicator counts, the exact triggering phrases, and a
cleaned context line.

• Adversary Intel: "no attribution found" now displays as a visible card instead
of easy-to-miss grey text.

• DMARC Analyser: full scorecard redesign — three category cards (Impersonation,
Privacy, Branding) with rounded borders, icons, score counters, and colour-coded
badge chips. BIMI split into BIMI / Image / Certificate chips. Chips are
clickable and scroll to their results section. Two new protocol checks added:
TLS-RPT and MTA-STS. Active DKIM selector probing (16 common selectors).
Section titles larger and bolder. Every row has an ⓘ tooltip.

• Navigation: browser-style back/forward pill (‹ ›) in the header, breadcrumb
trail, and Alt+Left / Alt+Right keyboard shortcuts.

• Sidebar: collapse/expand toggle — collapses to 40 px icon-only strip.

• URL Scanner: Chrome user-agent on redirect chains, friendly hop error messages
with collapsible technical detail, URLscan exponential backoff, search query
quoting fix.

• Email Analyser: Sender Domain Intelligence (domain age + DMARC/SPF check),
DKIM alignment check, phishing phrase word-boundary fix, batched IOC rendering.

• YARA Scanner: SHA-256 integrity check for rule downloads, AV false-positive
warning, actual rule count on completion.

• Auto-updater: upgraded from size check to SHA-256 verification; fails closed
if no digest is published.

• General: "How to?" renamed "Help", Windows taskbar AppUserModelID set,
silent exception handlers replaced with logged warnings, Settings Features
tab merged.

• UI: All scrollbars now match the dark theme — switched ttk scrollbar theme
from "default" (native Windows, ignores custom colours) to "clam" (fully
applies the dark navy palette). Affects every scrollable panel in the app.

• Auto-updater: "Up to Date" and other short dialogs no longer show a large
empty box — dialog body now sizes tightly to content. Scrollbar in the
update dialog is now dark-themed instead of the default white Windows control.

InCyter v0.0.1

InCyter — Cyber Threat Investigation Platform

InCyter is a desktop application built for SOC analysts, incident responders,
and security professionals. It consolidates threat intelligence lookups, OSINT
queries, malware analysis, and domain investigation into a single fast interface.

Some Anti-Viruses or EDRs might block the download of the exe file due to the packaging and not having an Signed Authority certificate. You can Download the zip file as a workaround.

Created by Fady Azzi | © 2026