InCyter v0.0.6

InCyter v0.0.6 - What's New

A release about finishing the job

v0.0.5 built File Analysis. v0.0.6 makes it a tab you can actually work a sample in.

InCyter used to report a fact and stop one step short of the answer it raises. It said "400 KB of high-entropy bytes appended after the last section" and gave you no way to look at them. It said "this is a .NET assembly" and told you to find a decompiler. That gap is what this release closes.

Archives: RAR, 7z, CAB, ISO, TAR, GZ, BZ2 and XZ

The Archive lens read ZIP properly, .7z shallowly, and everything else failed with "Invalid or corrupt ZIP file". A RAR carrying one malicious file among four innocent ones could not be opened at all.

Every format now gets the same analysis: per-entry SHA-256 and MD5, content classification, macro confirmation, lure detection, flags and scoring. A test packs the same five files as ZIP, 7z, RAR, solid RAR and TAR and requires all five analyses to come out identical. Which reader handles an archive is decided by content, so a .rar renamed .zip still opens.

Nothing is written to disk - members are streamed into memory and capped. Only "Scan Contents", which you click, writes a file out. A 60-file RAR lists, classifies and hashes every entry in 1.9 seconds.

Encrypted archives are handled in three states: contents encrypted, file list encrypted, or clear. Archives locked with the passwords malware distributors reuse - infected, virus, password, 1234 - open themselves, and hiding the file list is itself scored.

.NET assemblies are read as .NET

Roughly half of commodity malware is managed code - AsyncRAT, Quasar, njRAT and their forks. Everything the PE inspector said about such a sample described the CLR wrapper every .NET binary shares: "Imports" listed one entry, mscoree.dll, because the runtime resolves the rest at load time.

There is now a .NET Assembly section reading the CLI metadata directly:

• The name the assembly was compiled as, which survives renaming the file
• The MVID - a build-time GUID. Two files sharing one came out of a single compilation, however differently they are packed or named. No native equivalent exists
• P/Invoke declarations - the Win32 APIs managed code actually reaches for, which is the real import table of a .NET binary. Injection calls are named and scored
• Embedded resources with offsets, so a packer's payload can be carved in one click
• Every string literal, and obfuscator markers (ConfuserEx, .NET Reactor, SmartAssembly and the rest)

The MVID read was checked against the .NET runtime's own answer on six real assemblies and matches exactly.

Hidden payloads can be pulled out

Appended data, embedded executables and .NET resources each carry an Analyse button. The bytes re-enter the same Any File analysis, so a carved payload gets identity detection, hashes and YARA for free - and a payload inside a payload works too.

Going back restores the previous page rather than re-analysing it. Measured on a 40 MB sample: analysis 2.0s, Back 0.30s. On a 2 GB file that is the difference between instant and minutes.

Memory dumps

Malware very often exists in RAM in a form it never took on disk - unpacked, decrypted, injected. Minidumps and kernel dumps are now read, the images inside listed, and any of them carved out and analysed.

YARA rules, written and tested for you

InCyter generates a rule from a sample, then verifies it before you see it: compiled, run against the sample, and run against a corpus of known-good Windows binaries. If it matches something clean it is refined and tried again.

Also in File Analysis

• Two samples compared structurally - sections, imports, resources and .NET identity, with findings graded so a shared MVID does not carry the same weight as a shared icon
• A signed, legitimate build now says so up front, instead of leaving you to assemble that from six sections
• Every date in one place - compile, debug, signing and countersigning, with disagreements called out. The first version of this fired on 85% of signed Microsoft binaries; it now fires on 0% of a 220-binary corpus
• The header spent three lines saying one thing. File name, size and type now sit in the drop zone, which lightens when a file is loaded
• Carve buttons say what they are offering to analyse, instead of twenty identical "Analyse" buttons
• The Browse dialog has a file-type filter, which it had been missing entirely

The navigation gets out of the way

The left nav sat open permanently at 168 px, which is a lot of a laptop screen given how rarely you change tab. It now starts as a 54 px icon rail and opens on hover.

A pin in the top row makes it permanent: the page lays out beside the nav rather than under it, so nothing is covered.

InSentri

• Documents work properly. A PDF in Free chat is now actually seen, instead of being acknowledged and then denied. A document on "This page" no longer hides the page
• Summaries read the whole document rather than a handful of retrieved passages
• An image-only PDF says it has no readable text instead of quietly contributing nothing
• Conversation context is sized by what fits, not a fixed message count - why some chats seemed to forget what you had just discussed
• Stop works during a summary, measured at 1.04 seconds into an 11.3-second call
• Choosing Ollama and then closing it is no longer a dead end - the picker offers the built-in model in one click instead of a transport error
• CUDA picks the right card on a machine with more than one

Fixed

• .7z archives listed only ONE file, whatever they contained - the listing was split on the wrong line ending
• An archive with an encrypted file list would have hung the app, waiting on a console password prompt that never returns
• "Scan Contents" extracted the file and showed nothing - every format, ZIP included
• A correct password on an AES ZIP was refused. Python's own ZIP reader cannot decrypt AES at all, which is what modern tools produce by default
• An archive InCyter had just unlocked was then not analysed
• A damaged archive was presented as a healthy one, showing the entries it could recover as if they were all of them
• Pressing Back mid-analysis let the carved file paint over the parent page
• The collapsed nav highlighted the wrong tab, and the same scoping mistake was reaching history tagging and defanging
• A document summary stopped mid-word, and another came back as one word repeated two thousand times
• A failed analysis left the tab on "Loading..." for ever; it now says what went wrong
• Small, highly compressible files were denied a hash, inconsistently between formats
• A renamed .NET assembly and a repackaged one were reported as the same thing. They are not

Under the hood

Bundled tool licences now ship with the tools, in licenses\. A line-by-line audit of File Analysis was completed before release and found a real crash where two concurrent analyses fought over the same YARA rule file. The test suite stands at 24 automated suites, run before every build.

---

Installation: Run InCyterInstaller.exe - no Python required. Requires Windows 10/11 x64.