Back Home
Full list of VirusTotal Intelligence tag modifier
One of the search modifiers available in VirusTotal Intelligence is "tag". This modifier will search for files tagged with the literal provided. VirusTotal adds tags to all files processed based on hundreds of factors depending on the type of file, information extracted, behaviour, etc.
You can find the description and examples of the most common tags at the File search modifiers article.
Here is the full list of tags supported:
| 32lite | 3gp | 64bits | 7zip |
| ace | acprotect | acroform | aes-encoded |
| ahpack | alexprotector | alloy | android |
| anorganix | anskya | anti-analysis | apatch |
| apfs | apk | apple | appledouble |
| appleplist | applesingle | arc | arj |
| arm | armadillo | arsc | asd |
| asf | aspack | asprotect | assembly |
| attachment | auto-close | auto-create | auto-modify |
| auto-open | autoaction | avi | awk |
| axml | bambam | base64-embedded | base64-string |
| beria | bero | bittorrent | blade |
| blob | bmp | bobsoft | bzip |
| c | cab | calls-wmi | cap |
| capabilities | cdcops | cexe | checks-disk-space |
| checks-gps | checks-network-adapters | checks-user-input | chm |
| clipboard | code | codesafe | coff |
| com | contains-apk | contains-deb | contains-dmg |
| contains-drv | contains-elf | contains-embedded-js | contains-macho |
| contains-msi | contains-pe | contains-rom | contains-zip |
| copy-file | coredump | corrupt | corrupted |
| cpp | create-dir | create-file | create-ole |
| createinstall | crinkler | crunch | crx |
| crypkey | crypt | crypto | cve-* |
| cydia | dbpe | ddem | deb |
| depack | detect-debug-environment | dex | diminisher |
| dingboy | direct-cpu-clock-access | dmg | doc |
| docx | domain-pattern | dos-stub | download |
| dropper | dxpack | dyalog | dyn-calls |
| dyn-class | dzip | ebook | efi |
| elf | email-pattern | emf | |
| empty | encrypted | encryptpe | enigma |
| enum-windows | environ | eot | eps |
| escargot | exe-embedded | exe-pattern | exe32pack |
| execryptor | executes-dropped-file | exejoiner | exelocker |
| exepack | exepacker | exeshield | exesmasher |
| exestealth | exploit | exploit-kit | expressor |
| ext-interface | ext-prg | ezip | faulty |
| feokpt | file-embedded | fla | flac |
| flash | flash-embedded | flc | fli |
| flv | fortran | fpx | fres |
| freshbind | fscommand | fsg | ftp |
| ftp-communication | fusion | gamehouse | gif |
| gimp | goats | goodware | gpt |
| gul | gzip | hackstop | handle-file |
| hash-collision | hasp | hfs | hide-app |
| honeypot | hosts-modifier | html | html-control |
| hwp | ico | iecookie | iframe |
| indesign | installshield | installstub | intel-me |
| invalid-signature | invalid-xref | ios | ipbprotect |
| iphone | ipv4-pattern | irc | isoimage |
| jar | java | java-bytecode | javascript |
| jdpack | jng | jpeg | js-embedded |
| jspack | kbys | kgb | kkrunchy |
| known-distributor | krnl | krunchy | krypton |
| kryptor | lamecrypt | latex | launch-action |
| lcc | lib | license | linux |
| lnk | loadbytes | long-base64 | long-hex |
| long-sleeps | lzexe | lzma | mac |
| mac-app | mac-publisher | machfs | macho |
| maclib | macros | malformed | malware |
| matcho | mew | microjoiner | midi |
| mmbuilder | mobile-substrate | molebox | morphine |
| mp3 | mp4 | mpeg | mscompress |
| msi | multi-arch | mysql | mysql-communication |
| mz | nakedpack | native | neexe |
| neolite | nfo | northstar | npack |
| nsis | nspack | ntkrnl | nullsoft |
| nxdomain | obfuscated | obsidium | odex |
| odg | odp | ods | odt |
| ogg | ole-autolink | ole-control | ole-embedded |
| ole-link | open-file | opendir | orien |
| outlook | overlay | pack200 | packman |
| palmos | pascal | password-dialog | pcguard |
| pcshrinker | pe | pe-armor | |
| pearmor | pebundle | pecompact | pecrc32 |
| pecrypt32 | pedll | peexe | penightmare |
| peninja | pepack | peprotect | perl |
| persistence | peshield | peshit | pespin |
| petite | pex | php | pkg |
| pklite | pklite32 | png | polyene |
| postinst | postrm | powershell | ppsx |
| ppt | pptx | preinst | prerm |
| ps | psd | punisher | python |
| qt | radpack | rar | rar-embedded |
| rcryptor | reflection | registry | relocatable |
| repeated-clock-access | revoked-cert | rlpack | rm |
| rom | rpm | rtf | ruby |
| run-dll | run-file | runtime-modules | rzip |
| save-workbook | script | sdprotect | sdprotector |
| self-delete | send-keys | sends-sms | shared-lib |
| shell | shellcode | signed | simplepack |
| smtp | softdefender | ssh | starforce |
| startup-folder | stealth | stones | sudo |
| suspicious-dns | suspicious-eip | suspicious-udp | svg |
| svkprotector | symbian | system-library | tag |
| tar | tar-bundle | targa | telephony |
| telnet | telock | text | themida |
| thinstall | tiff | tlpack | trojan |
| ttf | uefi | upack | upx |
| url-pattern | usb-autorun | vba | vcasm |
| via-tor | virogen | wav | winrar |
| winzip | wise | woff | worm |
| write-file | wwpack | xcr | xls |
| xlsx | xml | xorcrypt | xpi |
| xws | yoda | yodaprot | yodaprotect |
| zero-filled | zip | zip-embedded | zipped |
| zlib |
List of deprecated tags:
| invalid-rich-pe-checksum | invalid-rich-pe-duplicated-entries | invalid-rich-pe-linker-version |
| invalid-rich-pe-modified-iat | nsrl | trusted |