Unveiling Hidden Threats in PDFs with Hybrid Malware Classification

Antivirus developers encounter significant challenges in handling PDF files due to their susceptibility to various types of malwares. These threats span from exploiting inherent vulnerabilities in PDF readers to employing phishing tactics and injecting JavaScript and shellcodes for malicious purposes. Our methodology encompasses the extraction of a defined set of static features complemented by dynamic behavioral indicators that may manifest during attacks. We integrate established Python-based tools with our framework to facilitate the static extraction process. Sandbox is utilized to identify potential infection attempts occurring during runtime execution. Additionally, for PDF classification purposes, the VirusTotal API is employed for PDF labeling. Subsequently, several machine learning-based classifiers such as Random Forest (RF), k-Nearest Neighbors (KNN), and Support Vector Machine (SVM) are utilized. These classifiers undergo evaluation based on metrics including Accuracy, Precision, Recall, and F'1-Score. Experimental analysis demonstrates that the the proposed system offers an efficacious solution for the classification of PDF malware.