Quttera is a set of heuristic and non-signature based investigation engines designed especially to detect security vulnerability exploits hidden in legitimate web-site content.

Quttera capable to detect JavaScript exploits found in HTML pages, malicious PDF files and exploits hidden in images and other media content.

In software, security vulnerability basically refers to a bug or defect in program/application which allows cyber-criminals to execute malicious code that further download and execute malware.

The initial target of vulnerability exploit is to gain control over CPU of an attacked computer and further open a communication channel with attacker (or dedicated server). In majority of the cases such connection is then used to download and execute malicious software on the invaded system.

In most of the cases this is due to a server load. If the large amount of users submit the URL then the speed of the investigation decreases.You can continue browsing our site or come back later and enter the same URL to check what is the status of its investigation.

After the URL is submitted you can observe its status in the "Current status" field. When the content is being downloaded the status is changed to "Download".This stage of the process might take a while due to traffic limits or low download speed. Basically, investigation time = download time + scan time.

HTML file may contain separated JavaScript code in several places and in addition it might contain "includes" from another JavaScript files. What is done in all-include.js file is a merge of all JavaScript sections and code found in external "include" into a single file. Sometimes, invocation of the vulnerability exploit is located in the HTML file and the body of exploit is located in external "include".

In the majority of cases this is due to the redundant spacing. Make sure you haven't added space before and/or after a URL string in the URL input box.

Clean investigation state means that Quttera investigation engine didn't find any signs of malicious or suspicious activity in any of investigated files.

At least one file is Potentially Suspicious and the rest are Clean. Potentially Suspicious status assigned to pages that contain HTML/JavaScript content previously met in both malicious and clean sites. There is high probability that this content is clean but it still requires your attention to eliminate any doubts. Pages under this status may contain hidden iframes and some well-known encoding procedures used to decrease size of JavaScript code.

At least one file is Suspicious and the rest are Clean or Potentially Suspicious or both. Suspicious status assigned to files that contains HTML tags and JavaScript code previously met in malicious sites and it is unlikely to be used for non-malicious activities. Pages under this status may contain reference to hidden URLs, iframes referencing hidden URLs, obfuscation of JavaScript code that could be used for malicious activities.

At least one file is Malicious and the rest are Clean or Potentially Suspicious or Suspicious or files of all three types. Malicious status assigned to files containing binary vulnerability exploits, PDF files containing malicious elements like embedded PE files and other known and/or "zero-day" threats.