InCyter v0.0.3

InCyter v0.0.3 - What's New (MAJOR Update)

Malware Analysis - deeper detection across all four analysers

PE/MSI Inspector, ZIP Analyser, Office & Macro Analyser, and PDF Analyser all got a major detection upgrade: context-aware risk scoring that dampens false positives on signed/trusted software, optional YARA signature scanning with tiered scoring, and a consistent "why this verdict" panel (summary, legend, and rationale) so you can see exactly what triggered a risk score instead of an opaque badge.

• PE/MSI Inspector: YARA scanning, refined attack-capability detection (process injection/hollowing), Authenticode-aware scoring
• ZIP Analyser: YARA scanning on archive contents, lure-filename detection, nested-archive recursion limits
• Office & Macro Analyser: DDE field detection, embedded OLE object detection, remote template injection detection, safe static decoding of obfuscated VBA strings
• PDF Analyser: JavaScript decoding, embedded file extraction with a direct "Extract & Open" pivot into the right analyser, digital signature and Launch-action detection
• All four: file hashing, YARA match details, and a "Send to Bulk Scan" pivot for extracted IOCs

Email Analyser - rebuilt for real-world phishing detection

• Restructured into three tabs - Technical Info, Threat Analysis, IOCs - instead of nested sub-tabs
• Real email parsing: multipart, base64, and quoted-printable bodies now decode correctly. HTML-only emails (the majority of real phishing lures) are now actually analysed instead of showing an empty body
• Threat Analysis now factors in SPF/DKIM/DMARC authentication failures and detects link text/href mismatches (a link that displays one domain but points to another)
• IOCs tab now also catches link targets hidden behind generic text like "Click Here"
• Streamlined toolbar - IOCs populate automatically on Analyse, so the separate "Scan IOCs" button was removed

Bulk Scan - usable without a VirusTotal API key

New "Open in browser" control opens a batch of 5 or 10 IOCs' VirusTotal report pages directly in your browser - no API key required. The warning banner now only appears when actually relevant, scans that are cancelled mid-way no longer get stuck on "Pending...", and the Copy button in the IOCs list now works correctly.

Home Page - Live Threat Intelligence Feed

The home page now shows a live multi-source cybersecurity news feed. Sources: CISA KEV, ACSC (cyber.gov.au), BleepingComputer, The Hacker News, and Cyber Security News. Toggle each source on or off - preference saved between sessions. Refreshes once daily after 05:00 local time with manual refresh available.

Hash Cracker (new)

New sub-tab under Pass/Hash Crack for cracking MD5, SHA-1, SHA-256, SHA-512, SHA3-256, NTLM, and bcrypt hashes. Algorithm auto-detected from hash length/prefix. Supports Offline, Wordlist, and Mask Attack modes. Hashcat GPU integration with one-click download - no manual setup required. Imports file hashes directly from Password Cracker.

ZIP Analyser (new)

New tab under File Analysis. Lists all files in a ZIP with type, size, and risk flags. Detects executables, scripts, zip bombs, path traversal, double extensions, nested ZIPs, and polyglot files. Scan Contents extracts and opens any internal file in the correct analyser tab.

Password Cracker - additions

Mask Attack mode, Export Hash button for Hashcat-ready output, InCyter Repo browser for wordlists, Help button.

DMARC Analyser - SPF Tree View and IP Export

Tree View is now the default view, showing nested SPF includes with click-to-expand hierarchy and provider tags. The flat view is now called List View. New Export IPs button exports the full authorised IP list to CSV or PDF.

Export - HTML and PDF for all tabs

The Export button on every tab now offers HTML and PDF. Reports are structured with section headings, labelled rows, and colour-coded values - not a raw text dump.

Email Analyser - Drag and Drop

Drag emails directly from the Outlook desktop app, or drag .msg/.eml files from Explorer, straight onto the Email Analyser input.

Input History and Autocomplete

Every main search field now remembers previous inputs and suggests matches as you type. History is grouped by field type (Domain Tools, IP, Domain, URL, CVE, Software, Hash Cracker) and shared across related tabs. Up to 40 entries per category, saved across sessions.

Encrypted Files - Info Icons

Every row in the Encryption Details section now has a hover tooltip (i) with a plain-English explanation of that field - covering all formats including PGP/GPG, Age, Microsoft Purview, Office, PDF, ZIP, BitLocker, and OpenSSL.

Settings - Features - Granular Sub-tab Control

The Features page now shows all nested sub-tabs as individual toggles:

• File Analysis: PE/MSI Inspector, ZIP Analyser, Office & Macro, PDF, Metadata, YARA Scanner, Strings
• Pass/Hash Crack: Password Cracker, Hash Cracker
• IOC Extract & Defang: Text Extract, File/PCAP, Image/PDF OCR, QR Code, Regex Tester
• Encoder/Decoder: Decode & Encode, JWT
• Email Analyser: Technical Info, Threat Analysis, IOCs

Settings & Updates polish

The About page description now reflects the full current toolset. The automatic "What's New" popup no longer shows stale or mismatched release notes when running a build ahead of what's published. Release notes and changelogs now render with real formatting (headers, bold, bullet lists) instead of raw markdown text.

Other improvements

• PE/MSI Inspector: MSI/MSM/MSP support, Risk Verdict badge, Authenticode, PE anomalies, suspicious imports
• PDF Analyser: password-protected PDFs, Show Content section
• Office & Macro: document text viewer, collapsible VBA section, plain-English macro summary
• Metadata: password-protected Office and PDF files now supported
• History logging added for all tools (PE Inspector, YARA, Fuzzy Hash, Strings, Metadata, Office, PDF, ZIP, Password Cracker, Hash Cracker)
• Log retention: 30-day rolling retention for all log files
• Toolkit moved to Tools section in sidebar
• All help buttons documented and working
• New app icon, dark title bar on all dialogs