Full list of VirusTotal Intelligence tag modifier
One of the search modifiers available in VirusTotal Intelligence is "tag". This modifier will search for files tagged with the literal provided. VirusTotal adds tags to all files processed based on hundreds of factors depending on the type of file, information extracted, behaviour, etc.
You can find the description and examples of the most common tags at the File search modifiers article.
Here is the full list of tags supported:
32lite | 3gp | 64bits | 7zip |
ace | acprotect | acroform | aes-encoded |
ahpack | alexprotector | alloy | android |
anorganix | anskya | anti-analysis | apatch |
apfs | apk | apple | appledouble |
appleplist | applesingle | arc | arj |
arm | armadillo | arsc | asd |
asf | aspack | asprotect | assembly |
attachment | auto-close | auto-create | auto-modify |
auto-open | autoaction | avi | awk |
axml | bambam | base64-embedded | base64-string |
beria | bero | bittorrent | blade |
blob | bmp | bobsoft | bzip |
c | cab | calls-wmi | cap |
capabilities | cdcops | cexe | checks-disk-space |
checks-gps | checks-network-adapters | checks-user-input | chm |
clipboard | code | codesafe | coff |
com | contains-apk | contains-deb | contains-dmg |
contains-drv | contains-elf | contains-embedded-js | contains-macho |
contains-msi | contains-pe | contains-rom | contains-zip |
copy-file | coredump | corrupt | corrupted |
cpp | create-dir | create-file | create-ole |
createinstall | crinkler | crunch | crx |
crypkey | crypt | crypto | cve-* |
cydia | dbpe | ddem | deb |
depack | detect-debug-environment | dex | diminisher |
dingboy | direct-cpu-clock-access | dmg | doc |
docx | domain-pattern | dos-stub | download |
dropper | dxpack | dyalog | dyn-calls |
dyn-class | dzip | ebook | efi |
elf | email-pattern | emf | |
empty | encrypted | encryptpe | enigma |
enum-windows | environ | eot | eps |
escargot | exe-embedded | exe-pattern | exe32pack |
execryptor | executes-dropped-file | exejoiner | exelocker |
exepack | exepacker | exeshield | exesmasher |
exestealth | exploit | exploit-kit | expressor |
ext-interface | ext-prg | ezip | faulty |
feokpt | file-embedded | fla | flac |
flash | flash-embedded | flc | fli |
flv | fortran | fpx | fres |
freshbind | fscommand | fsg | ftp |
ftp-communication | fusion | gamehouse | gif |
gimp | goats | goodware | gpt |
gul | gzip | hackstop | handle-file |
hash-collision | hasp | hfs | hide-app |
honeypot | hosts-modifier | html | html-control |
hwp | ico | iecookie | iframe |
indesign | installshield | installstub | intel-me |
invalid-signature | invalid-xref | ios | ipbprotect |
iphone | ipv4-pattern | irc | isoimage |
jar | java | java-bytecode | javascript |
jdpack | jng | jpeg | js-embedded |
jspack | kbys | kgb | kkrunchy |
known-distributor | krnl | krunchy | krypton |
kryptor | lamecrypt | latex | launch-action |
lcc | lib | license | linux |
lnk | loadbytes | long-base64 | long-hex |
long-sleeps | lzexe | lzma | mac |
mac-app | mac-publisher | machfs | macho |
maclib | macros | malformed | malware |
matcho | mew | microjoiner | midi |
mmbuilder | mobile-substrate | molebox | morphine |
mp3 | mp4 | mpeg | mscompress |
msi | multi-arch | mysql | mysql-communication |
mz | nakedpack | native | neexe |
neolite | nfo | northstar | npack |
nsis | nspack | ntkrnl | nullsoft |
nxdomain | obfuscated | obsidium | odex |
odg | odp | ods | odt |
ogg | ole-autolink | ole-control | ole-embedded |
ole-link | open-file | opendir | orien |
outlook | overlay | pack200 | packman |
palmos | pascal | password-dialog | pcguard |
pcshrinker | pe | pe-armor | |
pearmor | pebundle | pecompact | pecrc32 |
pecrypt32 | pedll | peexe | penightmare |
peninja | pepack | peprotect | perl |
persistence | peshield | peshit | pespin |
petite | pex | php | pkg |
pklite | pklite32 | png | polyene |
postinst | postrm | powershell | ppsx |
ppt | pptx | preinst | prerm |
ps | psd | punisher | python |
qt | radpack | rar | rar-embedded |
rcryptor | reflection | registry | relocatable |
repeated-clock-access | revoked-cert | rlpack | rm |
rom | rpm | rtf | ruby |
run-dll | run-file | runtime-modules | rzip |
save-workbook | script | sdprotect | sdprotector |
self-delete | send-keys | sends-sms | shared-lib |
shell | shellcode | signed | simplepack |
smtp | softdefender | ssh | starforce |
startup-folder | stealth | stones | sudo |
suspicious-dns | suspicious-eip | suspicious-udp | svg |
svkprotector | symbian | system-library | tag |
tar | tar-bundle | targa | telephony |
telnet | telock | text | themida |
thinstall | tiff | tlpack | trojan |
ttf | uefi | upack | upx |
url-pattern | usb-autorun | vba | vcasm |
via-tor | virogen | wav | winrar |
winzip | wise | woff | worm |
write-file | wwpack | xcr | xls |
xlsx | xml | xorcrypt | xpi |
xws | yoda | yodaprot | yodaprotect |
zero-filled | zip | zip-embedded | zipped |
zlib |
List of deprecated tags:
invalid-rich-pe-checksum | invalid-rich-pe-duplicated-entries | invalid-rich-pe-linker-version |
invalid-rich-pe-modified-iat | nsrl | trusted |