We delete Acrotray_Anomaly

This rule works with external variables.

malware/APT_Cloudduke.yar

@@ -38,25 +38,6 @@ rule CloudDuke_Malware {
 		uint16(0) == 0x5a4d and filesize < 720KB and 4 of ($s*) and 1 of ($op*)
 }
 
-/* Inverse Rules ----------------------------------------------------------- */
-/* Warning: this rule works with the external variable 'filename' only       */
-
-rule Acrotray_Anomaly {
-	meta:
-		description = "Detects an acrotray.exe that does not contain the usual strings"
-		author = "Florian Roth"
-		score = 75
-	strings:
-		$s1 = "PDF/X-3:2002" fullword wide
-		$s2 = "AcroTray - Adobe Acrobat Distiller helper application" fullword wide
-		$s3 = "MS Sans Serif" fullword wide
-		$s4 = "COOLTYPE.DLL" fullword ascii
-	condition:
-		uint16(0) == 0x5a4d and filesize < 3000KB 
-		and ( filename == "acrotray.exe" or filename == "AcroTray.exe" )
-		and not all of ($s*) 	
-}
-
 /* Super Rules ------------------------------------------------------------- */
 
 rule SFXRAR_Acrotray {