{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.06778014, "rte": "az", "prob": 0.06778014 }, { "cls": 0, "raw": 0.00043797493, "rte": "az/source", "prob": 0.00043797493 }, { "cls": 0, "raw": 0.97646797, "rte": "az/c", "prob": 0.97646797 } ], "prob": 0.06778014, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.06778013706207275 } ], "version": "v18.18", "analyzed_at": "2026-06-10T10:19:52Z" }, "path": "TuberculosisR.cpp", "raw": { "v": "7", "tv": "46abf", "files": [ { "id": 0, "ctx": [ { "a": 0, "l": 1, "t": "#include \"Tuberculosis.hpp\"" }, { "a": 29, "l": 2, "n": [ { "c": 3, "d": "Code explicitly mentions malware/backdoor", "i": "objectives/evasion/kernel-hide/lkm/hiding::malware-mention-comment-malware", "o": 29, "z": 103 } ], "t": "/* TuberculosisR.exe by NotCCR" }, { "a": 61, "l": 3, "t": "This malware was made for my good friends: N17Pro3426, RaduMinecraft, MrSuperBuddy, Come on Dell and Kwinda." }, { "a": 171, "l": 4, "t": "It only runs on Windows XP." }, { "a": 1785, "l": 18, "t": "\tBootSector::DestroyMBR();" }, { "a": 1813, "l": 19, "t": "\tRegistry::SystemDisabler();" }, { "a": 1843, "l": 20, "n": [ { "c": 2, "d": "Delay execution with Sleep in source", "i": "micro-behaviors/time/timing/delay::sleep-source", "o": 1844, "z": 5 } ], "t": "\tSleep(6000);" }, { "a": 1858, "l": 21, "n": [ { "c": 3, "d": "CreateThread usage in source", "i": "micro-behaviors/process/thread/create::create-thread-source", "o": 1874, "z": 12 } ], "t": "\tHANDLE hJPEG = CreateThread(NULL, 0, GDIEffects::JPEGCompression, NULL, 0, 0);" }, { "a": 1939, "l": 22, "n": [ { "c": 2, "d": "Joystick, gamepad, or DirectInput keyword", "i": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword", "o": 1977, "z": 6 } ], "t": "\tCreateThread(NULL, 0, Inputs::KeyboardInputs, NULL, 0, 0);" }, { "a": 2000, "l": 23, "t": "\tHANDLE hDP = CreateThread(NULL, 0, GDIEffects::DarkPixelation, NULL, 0, 0);" }, { "a": 2078, "l": 24, "t": "\tSound1();" } ], "mol": "O(Er)H(Po)", "sha": "e572df1dd87a9589931eee178d3ace2e4e77cb29dc861bca3de6bb2cca91a69c", "fact": { "id": "c", "imp": [ [ "", "MessageBoxW" ], [ "", "MessageBoxW" ], [ "", "CheckForWindowsXP" ], [ "", "NotWindowsXP" ], [ "", "DestroyMBR" ], [ "", "SystemDisabler" ], [ "", "Sleep" ], [ "", "CreateThread" ], [ "", "CreateThread" ], [ "", "CreateThread" ], [ "", "Sound1" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "CreateThread" ], [ "", "Sound2" ], [ "", "Sleep" ], [ "", "CreateThread" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "InvalidateRect" ], [ "", "CreateThread" ], [ "", "CreateThread" ], [ "", "CreateThread" ], [ "", "Sound3" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "InvalidateRect" ], [ "", "CreateThread" ], [ "", "CreateThread" ], [ "", "Sound4" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "CreateThread" ], [ "", "Sound5" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "InvalidateRect" ], [ "", "CreateThread" ], [ "", "CreateThread" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "InvalidateRect" ], [ "", "CreateThread" ], [ "", "CreateThread" ], [ "", "Sound6" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "InvalidateRect" ], [ "", "CreateThread" ], [ "", "Sleep" ], [ "", "CreateThread" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "CreateThread" ], [ "", "CreateThread" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "InvalidateRect" ], [ "", "CreateThread" ], [ "", "CreateThread" ], [ "", "Sleep" ], [ "", "CreateThread" ], [ "", "Sleep" ], [ "", "CreateThread" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "CreateThread" ], [ "", "CreateThread" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "InvalidateRect" ], [ "", "CreateThread" ], [ "", "Sound8" ], [ "", "Sleep" ], [ "", "EndPayload" ], [ "", "EndPayload" ], [ "", "InvalidateRect" ], [ "", "CreateThread" ], [ "", "Sound9" ], [ "", "Sleep" ], [ "", "SimulateSystemCrash" ], [ "", "Tuberculosis.hpp" ] ], "met": { "ast": { "op.eq": 2.0, "op.bor": 4.0, "op.lnot": 1.0, "max_depth": 10.0, "call_count": 93.0, "node_count": 1494.0, "op_density.eq": 0.0, "op_density.bor": 0.0, "op_density.lnot": 0.0, "identifier_count": 85.0, "string_literal_count": 5.0 }, "file": { "size": 5174.0, "entropy": 5.51, "size_bytes": 5174.0 }, "text": { "tab_count": 93.0, "digit_ratio": 0.06, "space_count": 478.0, "total_lines": 100.0, "char_entropy": 5.51, "unique_chars": 83.0, "lines_over_200": 2.0, "lines_over_500": 1.0, "string_density": 0.05, "avg_line_length": 49.74, "max_line_length": 907.0, "empty_line_ratio": 0.01, "last_line_length": 1.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.06, "identifier_density": 2.44, "line_length_stddev": 98.37, "normalized_string_count": 0.5, "suspicious_string_ratio": 0.2, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.17, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 12.79 }, "calls": { "count": 93.0 }, "binary": { "overall_entropy": 5.51 }, "source": { "function_count": 1.0 }, "imports": { "count": 1.0, "unique_modules": 1.0, "third_party_count": 1.0, "third_party_ratio": 1.0 }, "strings": { "total": 5.0, "avg_length": 239.2, "max_length": 783.0, "avg_entropy": 4.46, "sql_strings": 1.0, "total_bytes": 1196.0, "entropy_stddev": 0.43 }, "comments": { "chars": 321.0, "lines": 9.0, "total": 6.0, "to_code_ratio": 0.1, "high_entropy_comments": 1.0 }, "functions": { "count": 1.0 }, "identifiers": { "count": 85.0, "total": 244.0, "avg_length": 8.36, "max_length": 19.0, "min_length": 3.0, "avg_entropy": 2.65, "reuse_ratio": 0.35, "unique_count": 85.0, "length_stddev": 4.35, "has_digit_ratio": 0.21, "base64_like_names": 3.0, "high_entropy_count": 12.0, "high_entropy_ratio": 0.14, "all_lowercase_ratio": 0.05, "all_uppercase_ratio": 0.09, "numeric_suffix_count": 18.0, "keyboard_pattern_names": 2.0 } }, "str": [ [ 9, "u8", "Tuberculosis.hpp" ], [ 10, "u8", "Tuberculosis.hpp" ], [ 390, "u8", "L\"You\\'re about to run the TuberculosisR.exe GDI-Trojan horse made by NotCCR, to be exclusively shown on the N17Pro3426, RaduMin" ], [ 392, "u8", "You" ], [ 397, "u8", "re about to run the TuberculosisR.exe GDI-Trojan horse made by NotCCR, to be exclusively shown on the N17Pro3426, RaduMinecraft " ], [ 560, "u8", "The creator of this malware at no point has the intent for it to be used maliciously." ], [ 653, "u8", "If you" ], [ 661, "u8", "re running it on physical hardware or if you don" ], [ 711, "u8", "t know what you" ], [ 728, "u8", "re doing, press " ], [ 746, "u8", "No" ], [ 750, "u8", " and delete this file quickly!" ], [ 784, "u8", "Otherwise, if you are running on a controlled environment, like an isolated virtual machine, you can run it and nothing will hap" ], [ 953, "u8", "NotCCR is NOT responsible for any damage made using this malware, reverse-engineering it, or any artificial removal of these dis" ], [ 1094, "u8", "Press " ], [ 1102, "u8", "Yes" ], [ 1107, "u8", " if you are running on a virtual machine. Press " ], [ 1157, "u8", "No" ], [ 1161, "u8", " otherwise." ], [ 1175, "u8", "L\"GDI-Trojan.Win32.Tuberculosis.B: FIRST WARNING!" ], [ 1177, "u8", "GDI-Trojan.Win32.Tuberculosis.B: FIRST WARNING!" ], [ 1289, "10", "0" ], [ 1320, "u8", "L\"FINAL WARNING!!!\\r\\n\\r\\nIf you have read the previous message, running this malware can cause irreversible damage to your syst" ], [ 1322, "u8", "FINAL WARNING!!!" ], [ 1346, "u8", "If you have read the previous message, running this malware can cause irreversible damage to your system!" ], [ 1455, "u8", "NotCCR holds no responsibility for anything done as a result of this malware!" ], [ 1536, "u8", "Once you hit " ], [ 1551, "u8", "Yes" ], [ 1556, "u8", ", it" ], [ 1562, "u8", "s final!" ], [ 1578, "u8", "Still execute this Trojan?" ], [ 1607, "u8", "L\"GDI-Trojan.Win32.Tuberculosis.B: F?I?N?A?L? ?W?A?R?N?I?N?G?" ], [ 1609, "u8", "GDI-Trojan.Win32.Tuberculosis.B: F?I?N?A?L? ?W?A?R?N?I?N?G?" ], [ 1733, "10", "0" ], [ 1850, "10", "6000" ], [ 1893, "10", "0" ], [ 1931, "10", "0" ], [ 1934, "10", "0" ], [ 1959, "10", "0" ], [ 1992, "10", "0" ], [ 1995, "10", "0" ], [ 2033, "10", "0" ], [ 2070, "10", "0" ], [ 2073, "10", "0" ], [ 2097, "10", "32000" ], [ 2178, "10", "0" ], [ 2217, "10", "0" ], [ 2220, "10", "0" ], [ 2244, "10", "10000" ], [ 2286, "10", "0" ], [ 2318, "10", "0" ], [ 2321, "10", "0" ], [ 2333, "10", "7000" ], [ 2400, "10", "0" ], [ 2403, "10", "0" ], [ 2442, "10", "0" ], [ 2481, "10", "0" ], [ 2484, "10", "0" ], [ 2522, "10", "0" ], [ 2555, "10", "0" ], [ 2558, "10", "0" ], [ 2597, "10", "0" ], [ 2631, "10", "0" ], [ 2634, "10", "0" ], [ 2658, "10", "30000" ], [ 2726, "10", "0" ], [ 2729, "10", "0" ], [ 2767, "10", "0" ], [ 2804, "10", "0" ], [ 2807, "10", "0" ], [ 2846, "10", "0" ], [ 2881, "10", "0" ], [ 2884, "10", "0" ], [ 2908, "10", "34000" ], [ 2988, "10", "0" ], [ 3022, "10", "0" ], [ 3025, "10", "0" ], [ 3049, "10", "15000" ], [ 3100, "10", "0" ], [ 3103, "10", "0" ], [ 3144, "10", "0" ], [ 3182, "10", "0" ], [ 3185, "10", "0" ], [ 3224, "10", "0" ], [ 3257, "10", "0" ], [ 3260, "10", "0" ], [ 3272, "10", "15000" ], [ 3343, "10", "0" ], [ 3346, "10", "0" ], [ 3384, "10", "0" ], [ 3421, "10", "0" ], [ 3424, "10", "0" ], [ 3462, "10", "0" ], [ 3496, "10", "0" ], [ 3499, "10", "0" ], [ 3523, "10", "28000" ], [ 3573, "10", "0" ], [ 3576, "10", "0" ], [ 3614, "10", "0" ], [ 3645, "10", "0" ], [ 3648, "10", "0" ], [ 3674, "10", "3000" ], [ 3736, "10", "0" ], [ 3771, "10", "0" ], [ 3774, "10", "0" ], [ 3786, "10", "7000" ], [ 3885, "10", "0" ], [ 3920, "10", "0" ], [ 3923, "10", "0" ], [ 3961, "10", "0" ], [ 4000, "10", "0" ], [ 4003, "10", "0" ], [ 4015, "10", "10000" ], [ 4121, "10", "0" ], [ 4124, "10", "0" ], [ 4163, "10", "0" ], [ 4198, "10", "0" ], [ 4201, "10", "0" ], [ 4240, "10", "0" ], [ 4280, "10", "0" ], [ 4283, "10", "0" ], [ 4295, "10", "1000" ], [ 4337, "10", "0" ], [ 4374, "10", "0" ], [ 4377, "10", "0" ], [ 4389, "10", "2000" ], [ 4453, "10", "0" ], [ 4488, "10", "0" ], [ 4491, "10", "0" ], [ 4503, "10", "3000" ], [ 4582, "10", "0" ], [ 4616, "10", "0" ], [ 4619, "10", "0" ], [ 4658, "10", "0" ], [ 4690, "10", "0" ], [ 4693, "10", "0" ], [ 4705, "10", "18000" ], [ 4810, "10", "0" ], [ 4813, "10", "0" ], [ 4851, "10", "0" ], [ 4889, "10", "0" ], [ 4892, "10", "0" ], [ 4916, "10", "15000" ], [ 4985, "10", "0" ], [ 4988, "10", "0" ], [ 5036, "10", "0" ], [ 5068, "10", "0" ], [ 5071, "10", "0" ], [ 5095, "10", "10000" ], [ 5145, "16", "3221225489" ] ], "tgt": [ "CheckForWindowsXP", "CreateThread", "DestroyMBR", "EndPayload", "InvalidateRect", "MessageBoxW", "NotWindowsXP", "SimulateSystemCrash", "Sleep", "Sound1", "Sound2", "Sound3", "Sound4", "Sound5", "Sound6", "Sound8", "Sound9", "SystemDisabler" ], "val": { "file.stem": "TuberculosisR", "file.basename": "TuberculosisR.cpp", "source.language": "c", "source.imports[0]": "CheckForWindowsXP", "source.imports[1]": "CreateThread", "source.imports[2]": "DestroyMBR", "source.imports[3]": "EndPayload", "source.imports[4]": "InvalidateRect", "source.imports[5]": "MessageBoxW", "source.imports[6]": "NotWindowsXP", "source.imports[7]": "SimulateSystemCrash", "source.imports[8]": "Sleep", "source.imports[9]": "Sound1", "source.strings[0]": " and delete this file quickly!", "source.strings[1]": " if you are running on a virtual machine. Press ", "source.strings[2]": " otherwise.", "source.strings[3]": "3221225489", "source.strings[4]": "FINAL WARNING!!!", "source.strings[5]": "GDI-Trojan.Win32.Tuberculosis.B: F?I?N?A?L? ?W?A?R?N?I?N?G?", "source.strings[6]": "GDI-Trojan.Win32.Tuberculosis.B: FIRST WARNING!", "source.strings[7]": "If you", "source.strings[8]": "If you have read the previous message, running this malware can cause irreversible damage to your system!", "source.strings[9]": "L\"FINAL WARNING!!!\\r\\n\\r\\nIf you have read the previous message, running this malware can cause irreversible damage to your system!\\r\\nNotCCR holds no responsibility for anything done as a result of this malware!\\r\\nOnce you hit \\'Yes\\', it\\'s final!\\r\\n\\r\\nStill execute this Trojan?", "source.has_imports": true, "source.imports[10]": "Sound2", "source.imports[11]": "Sound3", "source.imports[12]": "Sound4", "source.imports[13]": "Sound5", "source.imports[14]": "Sound6", "source.imports[15]": "Sound8", "source.imports[16]": "Sound9", "source.imports[17]": "SystemDisabler", "source.imports[18]": "Tuberculosis.hpp", "source.strings[10]": "L\"GDI-Trojan.Win32.Tuberculosis.B: F?I?N?A?L? ?W?A?R?N?I?N?G?", "source.strings[11]": "L\"GDI-Trojan.Win32.Tuberculosis.B: FIRST WARNING!", "source.strings[12]": "L\"You\\'re about to run the TuberculosisR.exe GDI-Trojan horse made by NotCCR, to be exclusively shown on the N17Pro3426, RaduMinecraft and Kwinda channels on YouTube.\\r\\nThe creator of this malware at no point has the intent for it to be used maliciously.\\r\\n\\r\\nIf you\\'re running it on physical hardware or if you don\\'t know what you\\'re doing, press \\'No\\' and delete this file quickly!\\r\\nOtherwise, if you are running on a controlled environment, like an isolated virtual machine, you can run it and nothing will happen to your data on your main PC.\\r\\n\\r\\nNotCCR is NOT responsible for any damage made using this malware, reverse-engineering it, or any artificial removal of these disclaimers.\\r\\nPress \\'Yes\\' if you are running on a virtual machine. Press \\'No\\' otherwise.", "source.strings[13]": "NotCCR holds no responsibility for anything done as a result of this malware!", "source.strings[14]": "NotCCR is NOT responsible for any damage made using this malware, reverse-engineering it, or any artificial removal of these disclaimers.", "source.strings[15]": "Once you hit ", "source.strings[16]": "Otherwise, if you are running on a controlled environment, like an isolated virtual machine, you can run it and nothing will happen to your data on your main PC.", "source.strings[17]": "Press ", "source.strings[18]": "Still execute this Trojan?", "source.strings[19]": "The creator of this malware at no point has the intent for it to be used maliciously.", "source.strings[20]": "Tuberculosis.hpp", "source.strings[21]": "re about to run the TuberculosisR.exe GDI-Trojan horse made by NotCCR, to be exclusively shown on the N17Pro3426, RaduMinecraft and Kwinda channels on YouTube.", "source.strings[22]": "re doing, press ", "source.strings[23]": "re running it on physical hardware or if you don", "source.strings[24]": "s final!", "source.strings[25]": "t know what you", "source.functions[0]": "WinMain(HINSTANCE hinst, HINSTANCE hprevinst, LPSTR cmdline, int cmdshow)" } }, "find": [ { "id": "micro-behaviors/process/thread/create::create-thread-source", "conf": 0.8999999761581421, "crit": 3, "desc": "CreateThread usage in source" }, { "id": "micro-behaviors/data/text/keywords/lexicon::delete-verb", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive delete verb" }, { "id": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword", "conf": 0.949999988079071, "crit": 2, "desc": "Joystick, gamepad, or DirectInput keyword" }, { "id": "micro-behaviors/data/text/llm/override::llm-instruction-context", "conf": 0.7200000286102295, "crit": 1, "desc": "LLM instruction context" }, { "id": "objectives/evasion/kernel-hide/lkm/hiding::malware-mention-comment-malware", "conf": 1.0, "crit": 3, "desc": "Code explicitly mentions malware/backdoor" }, { "id": "micro-behaviors/time/timing/delay::sleep-source", "conf": 0.8199999928474426, "crit": 2, "desc": "Delay execution with Sleep in source" }, { "id": "micro-behaviors/data/text/keywords/lexicon::command-result-word", "conf": 0.4000000059604645, "crit": 1, "desc": "cmd/command/result vocabulary word" } ], "path": "TuberculosisR.cpp", "risk": 3, "size": 5174, "type": "c" } ] } }