PDFreak AI.

PDFs can carry JavaScript, embedded files, launch actions and obfuscated payloads, and they arrive by email every day. Signature-based antivirus catches known samples but misses new or disguised ones.

Large security teams answer this with commercial sandboxes and cloud AI services. Small SOC teams often can’t: the tools are expensive, and uploading a suspicious file, which may contain sensitive business data, to a third party is a privacy decision in its own right. They are also left with a verdict and no explanation.

PDFreak AI set out to answer three questions for a small team, on its own hardware: is this file malicious, what kind of threat is it, and what should I do about it?

The model was trained on 1,267 PDFs: 635 malicious samples from public malware-sharing sources, each verified with antivirus aggregators, and 632 benign documents from open repositories. Some benign files were deliberately chosen because they contain interactive elements, so the model couldn’t learn the shortcut “JavaScript means malicious”. All malware handling happened in an isolated VM with disposable snapshots.

Logistic regression, an SVM and a Random Forest were evaluated. The Random Forest won on robustness with mixed feature types, and because its feature importance can be read directly. It was tuned with 5-fold cross-validation on F1, using an 80/20 train/test split.

The 17 features

• pdfid_URI
• num_objs
• streams_per_object
• file_entropy
• num_streams
• file_size
• num_urls
• pdfid_ObjStm
• has_acroform_marker
• pdfid_AcroForm
• pdfid_OpenAction
• pdfid_EmbeddedFile
• pdfid_AA
• pdfid_JS
• js_entropy_avg
• pdfid_Launch
• has_javascript_marker

Permutation importance, SHAP and LIME were used to check that the model leans on sensible signals. The top three were URI references, object count and streams per object.

A verdict alone doesn’t help an analyst decide what to do. For every flagged file, PDFreak AI runs retrieval-augmented generation, entirely on its own hardware:

• Knowledge base: about 68,500 chunks, drawn from the malicious PDF corpus and from MITRE ATT&CK Enterprise techniques
• Retrieval: all-MiniLM-L6-v2 embeddings in a FAISS index, orchestrated with LangChain
• Model: Mistral 7B, served locally through Ollama, not fine-tuned
• Output: a threat category (phishing, JavaScript exploit, shellcode or embedded binary, obfuscated payload), an ATT&CK mapping, a plain-language summary and recommended actions

Example report · from the evaluation

verdict malicious

category JavaScript exploit

ATT&CK T1059.005

action monitor script execution events

Across 50 malicious files, 42 reports (84%) matched the true label, 45 (90%) referenced an appropriate ATT&CK technique, and 40 (80%) recommended mitigations consistent with standard playbooks.

Everything PDFreak AI touches is, by design, possibly malicious. So the service around the model is hardened as carefully as the model itself:

• 10 MB upload limit and a 50 MB decompression cap, so archives can’t balloon
• Timeouts on every analysis step
• Zip Slip-safe extraction, locked-down working directories (chmod 700) and an isolated temp area inside Docker
• No external API calls: the classifier and the language model both run locally

The web app is React 18 and Tailwind on the front, FastAPI with OpenAPI docs behind it, and Docker Compose around both. An analyst drags in a file and watches it move through analysis, classification and report generation. The result is a verdict with a confidence score, the file’s structure and indicators, and the AI summary.

Six weeks of cloud infrastructure for the whole project cost £109.39. Commercial cloud antivirus subscriptions can exceed £1,000 a year.

← All products