InCyter v0.0.5

InCyter v0.0.5 - What's New

A major update

The biggest release so far. Two new things lead it:

• InSentri - an AI assistant that runs entirely on your own machine
• InCyter Intelligence - InCyter's own verdict engine, now named and marked everywhere it speaks

Plus a rebuilt File Analysis, files identified by content instead of filename, and a new Script & LNK Analyser.

InSentri - a local AI analyst, built in (new)

Ask questions about whatever is on your screen. Explain this verdict. Summarise this page. Map it to MITRE ATT&CK. Draft the remediation. Compare this sample to the one I looked at earlier.

It runs on your machine. No cloud, no account, no data leaving your network unless you switch on web search yourself.

It is off until you want it. Nothing downloads, nothing loads, nothing runs until you enable it in Settings. Enabling it asks how you want it to run - a built-in model or your own Ollama server - then which model, with the size of each. Nothing is chosen for you and nothing is fetched until you say so.

It advises, it never overrules. Where InCyter has reached a verdict, InSentri explains it rather than replacing it.

Also worth knowing:

• Answers cite the section they came from, and clicking a citation jumps you there to check it
• Any hash, IP, domain or CVE in an answer is clickable: scan it in the right tab, or copy it defanged
• It docks into the window instead of floating, and can be popped out
• Chat history is encrypted locally, or can be switched off entirely
• A phishing email cannot talk it into anything: everything it reads is treated as evidence, never as instructions

InCyter Intelligence - InCyter's own verdicts, clearly marked

Every judgement InCyter makes now carries an "InCyter Intelligence" tag. It tells you the reasoning is InCyter's own, runs locally, and needs no internet.

Third-party results (raw YARA hits, VirusTotal figures) deliberately stay untagged, so the mark means something. Verdicts also show a "Why this score" breakdown listing each finding and what it added.

New under it: Capability Detection states what a file can actually do in plain English - "reads the clipboard", "takes screenshots", "creates a service" - each mapped to MITRE ATT&CK, instead of leaving you to infer intent from an import table.

GPU acceleration that checks before it commits

If you have an NVIDIA card, InSentri can run on it. InCyter now works out what your machine needs by itself: it reads the card, its memory, the driver version and what your processor supports, then fetches the build that matches. An older driver cannot run a newer CUDA release, so the right one is chosen rather than assumed.

It is checked before it is used. A GPU build that installs but will not actually run on your hardware is caught during setup and rolled back, so you are never left with an assistant that answers nothing. If it fails later anyway, InSentri drops back to CPU on its own and tells you why in plain English instead of a Windows error code.

Email Analyser - the headers, read properly

Technical Info now shows what the message headers were already telling you.

The delivery chain, with times. Each hop shows when it happened, how long it took, and whether that leg was encrypted, with the total transit time. Underneath, anything the timeline gives away: a hop stamped before the hop that handed to it (time cannot run backwards - that is a wrong clock or a forged header), a break where one hop does not line up with the next, a long unexplained stall, a leg that crossed unencrypted, and a Date that disagrees with when the first server actually saw the message.

Every domain the message claims. From, Reply-To, Return-Path and Message-ID side by side. A real phishing email tested against this asserts four different domains - each one was already a line in the indicators list, but seen together they are the whole story.

Who actually sent it. Where a message came through a mass-mailing platform (Drip, SendGrid, Mailchimp, Mailgun, Amazon SES and others) it is named, with the standard abuse address. Reporting the account behind it is faster than blocking a throwaway domain.

What the receiving mail system already decided. Microsoft stamps a spam confidence level on everything it delivers, and other gateways stamp their own verdict. InCyter never read any of it. Now it does - a second opinion you already had.

File Analysis - one drop zone instead of seven tabs

PE / MSI, ZIP and Office & PDF used to make you classify a file before InCyter had looked at it. Now there is one "Any File" drop zone: drop anything, InCyter works out what it is, and Metadata and Strings are there for the same file without dropping it again.

Files are identified by content, not by name

The extension is the one thing an attacker fully controls. InCyter now reads the file itself.

Drop an executable called "invoice.pdf" and it goes to the PE analyser, with a clear warning that the name disagrees with the contents. Double extensions and right-to-left override tricks are caught too, each mapped to its MITRE technique. Previously a mislabelled file went to the wrong analyser and simply failed.

No more freezing on huge files

A multi-gigabyte installer used to leave InCyter "Not Responding" for about a minute. There is still no size limit, but the work no longer blocks the window, progress is live, and Cancel actually stops it. A 2.3 GB file now takes about 16 seconds and stays responsive.

Script & LNK Analyser (new)

For the PowerShell one-liner from a Defender alert, or a suspicious shortcut. It peels layered obfuscation and shows every layer, so you see how the payload was hidden. A decoded layer that turns out to be an executable is extracted and sent to the PE analyser. Shortcuts are pulled apart properly, including the machine ID left behind by whoever built them. Nothing is ever executed.

Email Analyser - catches what text scanning misses

• QR codes in the body and attachments are decoded and treated as indicators. Quishing works precisely because the link is never text
• Phone numbers are picked out, for callback phishing that gives a number instead of a link
• Display-name impersonation, including homoglyph and mixed-script tricks
• Every link checked for the real host behind the visible text

Domain Tools - now opens on DMARC

• SPF Duplicate & Overlap Check finds addresses authorised twice through different includes, and names which providers they came from. SPF fails outright past 10 lookups, so this is a real outage risk
• DKIM Key Health replaces a badge that went green if any selector answered. It now flags weak keys under 2048-bit, revoked selectors and test-mode flags

Reports, redesigned

Exported HTML and PDF now read like the analysis page: section cards, verdict badges, InCyter's colours. Printing switches to a light layout. Reports can carry your own summary, and InSentri can draft it for you to edit.

Also new

• YARA works straight away. The engine now ships with InCyter and rules load automatically, instead of telling you to install something
• PE / MSI: collapsible sections, one-click fingerprint pivots (imphash, Rich header), and a proper signing-certificate view
• A one-time Terms screen on first launch, reopenable from Settings - About
• Model downloads use several connections at once, roughly halving the wait

Changed and removed

• "PE / MSI Inspector" is now "PE / MSI Analyser"; "Office & PDF" is now "Office & PDF Analyser"
• YARA Scanner moved out of File Analysis to sit beside Fuzzy Hash
• The Case feature in History has been removed. It tagged scans and filtered one list, but nothing else in InCyter used it. Existing history is untouched
• Uninstalling now removes InCyter's data folder, including anything InSentri downloaded

Fixed

• An executable named as a .pdf produced a parse error instead of an explanation
• Long text ran off the right edge in several File Analysis panels
• Switching to Metadata or Strings showed an empty panel until you re-dropped the file
• Tooltips ran off the screen instead of wrapping
• Pinning InCyter now keeps InSentri on top with it
• Dropping an email onto the "drag and drop" text did nothing; only the empty space around it worked
• InSentri could refuse a long email with a context error instead of answering it
• The download size shown for the larger model was 640 MB short of the real one
• Model and provider choices could look like every option was selected at once
• Settings could still offer to enable GPU acceleration after it had been installed

A full security review of the codebase was completed and every finding fixed.

---

Installation: Run InCyterInstaller.exe - no Python required. Requires Windows 10/11 x64.