Back Home
Full list of VirusTotal Intelligence tag modifier
One of the search modifiers available in VirusTotal Intelligence is "tag". This modifier will search for files tagged with the literal provided. VirusTotal adds tags to all files processed based on hundreds of factors depending on the type of file, information extracted, behaviour, etc.
You can find the description and examples of the most common tags at the File search modifiers article.
Here is the full list of tags supported:
| 32lite | contains-elf | expressor | krnl | overlay | sends-sms |
| 3gp | contains-embedded-js | ext-interface | krunchy | pack200 | shared-lib |
| 64bits | contains-macho | ext-prg | krypton | packman | shell |
| 7zip | contains-msi | ezip | kryptor | palmos | shellcode |
| ace | contains-pe | faulty | lamecrypt | pascal | signed |
| acprotect | contains-rom | feokpt | latex | password-dialog | simplepack |
| acroform | contains-zip | file-embedded | launch-action | pcguard | smtp |
| aes-encoded | copy-file | fla | lcc | pcshrinker |
smtp-communication
|
| ahpack | coredump | flac | lib | softdefender | |
| alexprotector | corrupt | flash | license | pe intro |
software-collection
|
| alloy | corrupted | flash-embedded | linux | pe-armor | ssh |
| android | cpp | flc | lnk | pearmor |
ssh-communication
|
| anorganix | create-dir | fli | loadbytes | pebundle | starforce |
| anskya | create-file | flv | long-base64 | pecompact | startup-folder |
| anti-analysis | create-ole | fortran | long-hex | pecrc32 | stealth |
| apatch | createinstall | fpx | long-sleeps | pecrypt32 | stones |
| apfs | crinkler | fres | lzexe | pedll | sudo |
| apk | crunch | freshbind | lzma | peexe | suspicious-dns |
| apple | crx | fscommand | mac | penightmare | suspicious-eip |
| appledouble | crypkey | fsg | mac-app | peninja | suspicious-udp |
| appleplist | crypt | ftp | mac-publisher | pepack | svg |
| applesingle | crypto | ftp-communication | machfs | peprotect | svkprotector |
| arc | cydia | fusion | macho | perl | symbian |
| arj | dbpe | gamehouse | maclib | persistence | system-library |
| arm | ddem | gif | macros | peshield | tag |
| armadillo | deb | gimp | malformed | peshit | tar |
| arsc | depack | goats | malware | pespin | tar-bundle |
| asd | detect-debug-environment | goodware | matcho | petite | targa |
| asf | dex | gpt | mew | pex | telephony |
| aspack | diminisher | gul | microjoiner | php | telnet |
| asprotect | dingboy | gzip | midi | pkg |
telnet-communication
|
| assembly | direct-cpu-clock-access | hackstop | mmbuilder | pklite | telock |
| attachment | dmg | handle-file | mobile-substrate | pklite32 | text |
| auto-close | doc | hash-collision | molebox | png | themida |
| auto-create | docx | hasp | morphine | polyene | thinstall |
| auto-modify | domain-pattern | hfs | mp3 | postinst | tiff |
| auto-open | dos-stub | hide-app | mp4 | postrm | tlpack |
| autoaction | download | honeypot | mpeg | powershell | trojan |
| avi | dropper | hosts-modifier | mscompress | ppsx | trusted |
| awk | dxpack | html | msi | ppt | ttf |
| axml | dyalog | html-control | multi-arch | pptx | uefi |
| bambam | dyn-calls | hwp | mysql | preinst | upack |
| base64-embedded | dyn-class | ico | mysql-communication | prerm | upx |
| base64-string | dzip | iecookie | mz | ps | url-pattern |
| beria | ebook | iframe | nakedpack | psd | usb-autorun |
| bero | efi | indesign | native | punisher | vba |
| bittorrent | elf | installshield | neexe | python | vcasm |
| blade | installstub | neolite | qt | via-tor | |
| blob | email-pattern | intel-me | nfo | radpack | virogen |
| bmp | emf | invalid-rich-pe-checksum | northstar | rar | wav |
| bobsoft | empty | invalid-rich-pe-duplicated-entries | npack | rar-embedded | winrar |
| bzip | encrypted | invalid-rich-pe-linker-version | nsis | rcryptor | winzip |
| c | encryptpe | invalid-rich-pe-modified-iat | nspack | reflection | wise |
| cab | enigma | invalid-signature | nsrl | registry | woff |
| calls-wmi | enum-windows | invalid-xref | ntkrnl | relocatable | worm |
| cap | environ | ios | nullsoft | repeated-clock-access | write-file |
| capabilities | eot | ipbprotect | nxdomain | revoked-cert | wwpack |
| cdcops | eps | iphone | obfuscated | rlpack | xcr |
| cexe | escargot | ipv4-pattern | obsidium | rm | xls |
| checks-disk-space | exe-embedded | irc | odex | rom | xlsx |
| checks-gps | exe-pattern | isoimage | odg | rpm | xml |
| checks-network-adapters | exe32pack | jar | odp | rtf | xorcrypt |
| checks-user-input | execryptor | java | ods | ruby | xpi |
| chm | executes-dropped-file | java-bytecode | odt | run-dll | xws |
| clipboard | exejoiner | javascript | ogg | run-file | yoda |
| code injection | exelocker | jdpack | ole-autolink | runtime-modules | yodaprot |
| codesafe | exepack | jng | ole-control | rzip | yodaprotect |
| coff | exepacker | jpeg | ole-embedded | save-workbook | zero-filled |
| com | exeshield | js-embedded | ole-link | script | zip |
| contains-apk | exesmasher | jspack | open-file | sdprotect | zip-embedded |
| contains-deb | exestealth | kbys | opendir | sdprotector | zipped |
| contains-dmg | exploit | kgb | orien | self-delete | zlib |
| contains-drv | exploit-kit | kkrunchy | outlook | send-keys | |