This chapter presents a novel framework for detecting malicious JavaScript embedded in Portable Document Format (PDF) files using a combination of static, dynamic, and memory forensic analysis techniques. The system initiates by monitoring PDF downloads in real time and extracting embedded JavaScript using the Origami framework. The extracted scripts are subjected to dynamic analysis in the malware-jail sandbox, where their behavior is observed in a controlled environment. By examining both obfuscated and de-obfuscated scripts, the system can detect a wide range of malicious activities. Features from the sandbox logs are then used to create a feature vector, which is analyzed using a random forest model for classification. The system achieves high detection accuracy, with the ability to distinguish between malicious and benign PDFs. In addition to file-based malware, the system is capable of detecting fileless malware through memory forensics. When a PDF is suspected of containing malicious content by our system, we execute the malicious extracted code present in the PDF and capture a memory snapshot and use tools like Volatility to analyze it. This allows for the detection of fileless malware, which operates solely in memory and avoids leaving traditional disk-based footprints. The integration of static, dynamic, and memory forensic approaches, provides a comprehensive solution for detecting complex malware, ensuring high accuracy and real-world applicability.