Environment Preparation

An AI agent sets up a secure, isolated environment to prevent accidental execution or infection:

• Virtual Machine Setup: Uses VirtualBox, VMware, or Hyper-V with network isolation (host-only or NAT).
• Snapshot Management: Takes clean snapshots before analysis and restores after each test.
• Tool Deployment: Ensures availability of essential tools:
  • Static Analyzers: PDFiD, pdf-parser, Didier Stevens’ tools, peepdf.
  • Dynamic Tools: Cuckoo Sandbox (with PDF support), Any.Run, Hybrid Analysis.
  • Monitoring Tools: Process Monitor, Wireshark, Sysmon.
  • JavaScript Decoders: Custom deobfuscators, SpiderMonkey shell.

Static Analysis

An AI-driven agent inspects the PDF without rendering or executing it:

• File Validation: Confirms actual PDF structure using magic bytes; detects fake extensions or hybrid files (e.g., PDF + ZIP).
• Object & Stream Analysis: Parses PDF objects using pdf-parser; identifies obfuscated or compressed streams.
• Malicious Keyword Detection: Flags:
  • /JavaScript, /AA (auto-actions), /OpenAction
  • /Launch (executes files), /URI (suspicious links)
  • eval(), app.launchURL(), doc.submitForm()
• Embedded Content Detection: Extracts and analyzes embedded files (e.g., EXE, DOC, SWF) using peepdf or binwalk.
• Hashing & IOC Matching: Computes MD5/SHA256 and checks against VirusTotal, AlienVault OTX, or internal threat DB.

Dynamic Analysis

The document is executed in a sandboxed environment to observe runtime behavior:

• Controlled Rendering: Opens the PDF in a monitored reader (e.g., Adobe Acrobat Reader DC in sandbox).
• Behavior Monitoring:
  • Tracks file drops (e.g., in %Temp%, %AppData%)
  • Logs registry changes (e.g., Run keys, COM objects)
  • Detects spawned processes (cmd.exe, mshta.exe, powershell.exe)
• Network Activity: Captures C2 callbacks, beaconing, or data exfiltration via Wireshark.
• JavaScript Execution Tracing: Logs JavaScript API calls within the PDF reader environment.

Advanced Analysis

For obfuscated or exploit-based PDFs, deeper techniques are applied:

• JavaScript Deobfuscation: Reconstructs encoded scripts using AST parsing or emulation (e.g., in peepdf or custom engine).
• Exploit Detection: Identifies use of known vulnerabilities (e.g., CVE-2013-0640, CVE-2018-4993) in PDF parsers.
• Memory Forensics: Dumps reader process memory to extract dropped payloads or shellcode.
• Entropy Analysis: Detects packed or encrypted payloads within streams.

Classification and Risk Assessment

An AI classification agent determines the threat type and risk level:

Threat Type

• Malicious JavaScript: Auto-executing scripts that download payloads.
• Embedded Payload: PDF contains a hidden executable or Office file.
• Exploit Document: Triggers vulnerability in reader software.
• Social Engineering Lure: Fake invoice, delivery notice, etc., with no active payload.

Risk Level

• Low: Benign content, no scripts or embedded files.
• Medium: Obfuscated JavaScript, suspicious URIs, but no execution.
• High: Confirmed payload drop or C2 communication.
• Critical: Exploit used with code execution or privilege escalation.

Reporting

A reporting agent generates a comprehensive analysis report:

• Document Overview: Filename, hash, PDF version, author, creation date.
• Threat Summary: Malware family (e.g., Emotet, IcedID), delivery method.
• Indicators of Compromise (IOCs):
  • File hashes (MD5, SHA256)
  • URLs, domains, IP addresses
  • Dropped filenames, registry keys
• TTPs (MITRE ATT&CK): T1059.004 (Visual Basic), T1204.002 (User Execution), T1071.001 (Web Protocols).
• Mitigation Recommendations:
  • Disable JavaScript in PDF readers.
  • Use sandboxed viewers or convert PDFs to plain text.
  • Block IOCs at network level.
  • Update Adobe Reader and apply exploit mitigations.

AI Agent Coordination

A central AI coordinator manages the entire workflow, assigning tasks to specialized agents (static, dynamic, deobfuscation, classification). It enables real-time decision-making, adaptive analysis depth, continuous learning from new samples, and integration with SOAR/SIEM platforms for automated response and IOC sharing.