rule Suspicious_pdf
{
condition:
	uint32(filesize-4)==0x00000000

}