InCyter v0.0.4

InCyter v0.0.4 - What's New

IP & ASN (new)

The IP scanner is now "IP & ASN". Enter an IP to see the network that owns it - ASN, organisation, country, registry, and CIDR prefix - or type an ASN (e.g. AS15169) to look up a whole network, with a link to every prefix it announces. Runs with no API key (Team Cymru over DNS + RDAP) and works behind firewalls. All the existing IP reputation lookups (VirusTotal, AbuseIPDB, GreyNoise, Shodan, ipinfo) are unchanged.

Extension Analyser (new)

New tab under Malware Analysis - File Analysis. Analyse a Chrome/Edge/Brave/Opera/Firefox extension for malicious behaviour without installing it: paste a store link or extension ID, or drop a .crx/.xpi/.zip file or unpacked folder. Scores permissions and host access, CSP relaxation, Manifest V2 vs V3, content-script scope, JavaScript red flags and packer obfuscation, and runs a YARA scan - plus best-effort store reputation. Tuned so legitimate-but-powerful extensions (ad blockers, password managers) don't cry wolf. Static analysis only - the extension is inspected, never run.

Safe Document Viewer (new)

A "View Document" button on the Office & PDF analyser lets you SEE a suspicious document safely inside InCyter, so you never open it in Adobe/Word.

• PDF: each page rendered as an image with navigation and zoom - embedded JavaScript, OpenAction and Launch actions are NOT executed
• Office (.docx/.xlsx/.pptx and macro-enabled): read-only preview of text, tables, images, and the VBA macro source - inspected, never run

Office & PDF - merged into one auto-detecting tab

"Office & Macro" and "PDF" are now a single "Office & PDF" tab. Drop or browse a file and InCyter detects the type and runs the right analyser automatically - Office documents to the macro/VBA analyser, PDFs to the PDF structure analyser. Detection is extension-first with a magic-byte fallback, so extensionless or mislabelled files still route correctly. Drop something that isn't a document and it points you to the right tab instead.

URL & Domain - merged into one auto-detecting tab

The separate "URL" and "Domain" scanners are now one "URL & Domain" tab. Type or paste an indicator and InCyter detects whether it's a full URL or a bare domain and points each service (VirusTotal, OTX, urlscan, ANY.RUN, etc.) at the correct endpoint. History is tagged with the right type automatically. The URL Shortener and filescan.io now work on bare domains too.

Email Analyser - forwarding awareness and attachments

• Forwarded mail is now understood. When SPF/DKIM/DMARC "fail" because a message was forwarded, InCyter explains why and shows the ORIGINAL sender's real authentication result from the ARC chain. If the original email is attached it can be re-analysed in one click; otherwise you can expand the ARC chain to see each hop. The verdict is never softened and content checks still run - a forwarded-but-malicious email is still flagged
• Attachments now have their own tab with a live count (e.g. "Attachments (2)"), each showing type/size, dangerous/double-extension/macro flags, SHA-256, and a "Send to Malware Analysis" button
• The sender domain is now read from the real address, so a spoof like "security@paypal.com" attacker@evil.ru is correctly treated as evil.ru
• Lookalike/impersonation check on the sender: flags punycode, mixed-script (homoglyph) and near-miss brand domains

Malware Analysis - deeper detection

• PE Inspector detects .NET/managed assemblies (shows the CLR version) and scans PE resources for embedded executables and high entropy
• Office & Macro detects Excel 4.0 (XLM) macros and VBA stomping; RTF files and embedded OLE objects are extracted, hashed, and routable to the right analyser
• ZIP Analyser shows each entry's own SHA-256/MD5, catches zip bombs spread across many mid-size entries (not just one huge file), and auto-tries common malware passwords (infected, virus, 1234, etc.) on encrypted archives before prompting

Domain Tools - stronger domain checks

• New combined "Domain Risk" verdict on WHOIS, blending domain age, registry/DNS status and live TLS posture, with the reasons listed
• New Typosquat/lookalike checker that generates typo variants of a domain and shows which are live
• SSL tab now performs a live TLS handshake to show the certificate the host actually serves (issuer, SANs, validity, self-signed/hostname-mismatch), alongside the crt.sh history

DMARC - SPF IP search and expandable DKIM

• New "Search IP" box on the SPF results: tells you if an IP is authorised, including membership of a range (e.g. "209.85.128.173 is inside 209.85.128.0/17") and which provider it belongs to
• DKIM selectors are now expandable, showing the key type/size, all record fields, the full public key, and the CNAME delegation so you can see which provider (SendGrid, Mailchimp, Mimecast, etc.) actually manages the key

ANY.RUN - analysis time and plan awareness

• New "Analysis time" setting (1 to 20 minutes) - the default sandbox run used to be only 60 seconds
• InCyter now detects your plan from the key, shows the exact environments your key can run, and warns before uploading a file that's over your plan's size limit

CVE - clearer priority

CVE Lookup now leads with a plain "ACT NOW / HIGH / MEDIUM / MONITOR" verdict that blends CVSS severity, EPSS exploitation probability and CISA KEV status. Software Search matches real CPE version ranges (fewer false hits), and MITRE ATT&CK search now also matches descriptions and lists clickable sub-techniques.

Toolkit - decoder, regex, JWT

• Obfuscation decoder peels layered encodings (e.g. base64 into gzip) and adds gzip, zlib, Base32, ROT-N and decimal-escape codecs
• Regex Tester shows capture groups per match and has a "Replace with" box
• JWT decoder shows the issued-at time and can verify HS256/384/512 signatures against a secret
• IOC Extract now also pulls IPv6 addresses and filters out benign document/namespace noise and private IPs

Investigation History - cases

• Group related scans into named cases and filter the history by case
• A "Re-open" button on every row jumps back into the originating tab with the IOC pre-filled and re-runs it
• The toolbar is split into filters and actions rows so nothing gets clipped

Home page - faster feed

The threat intelligence feed now shows articles as each source finishes loading (first results in well under a second) instead of staying blank, and it dims stories you've already opened so new items stand out.

Reputation lookups

Results are briefly cached (5 minutes) so repeating a lookup is instant and doesn't burn API quota; rate-limits are retried automatically; successful lookups are auto-logged to History; and Bulk Scan now corroborates IPs with AbuseIPDB and exports the filtered view.

Look and feel

• Every pop-up is now a consistent dark InCyter dialog centred on the window - no more stray white Windows message boxes
• The collapsed sidebar shows a clickable icon rail with a clean expand arrow

Security hardening

A full security audit was completed and every finding fixed - covering safer handling of malicious files (decompression bombs, crafted PDFs/Office/archives), stronger protection of your stored API keys, and guards against a poisoned config backup or feed. Nothing you need to configure; it's all under the hood.

Note - Password/Hash cracking moved to InCracker

Password and hash cracking is now a separate app, InCracker. InCyter's Encrypted Files analyser still tells you how crackable a file is and gives you the exact command to run.

Other improvements

• Fixed: File & Hash YARA scan said "No file loaded" after a file was loaded
• Fixed: PDF JavaScript hidden in indirect streams is now decoded; legacy .doc/.xls/.ppt metadata now reads correctly
• Fixed: IOC defanging no longer strips legitimate brackets/parentheses (IPv6 URLs survive)
• Fixed: VirusTotal verdict wording and colour now agree (Suspicious 1-4, Malicious 5+)
• Fixed: SSL tab no longer flags naturally-superseded old certificates as expired
• Fixed: Home page CVE quick-scan and clipboard "IOC detected" now land on CVE Lookup and search automatically
• Plain-text debug logs moved into a logs\ subfolder (auto-migrated); the log meant for bug reports is now redacted of any keys/tokens
• Project moved to github.com/FadyAzzi/InCyter (existing installs keep updating normally)

---

Installation: Run InCyterInstaller.exe - no Python required. Requires Windows 10/11 x64.