Full list of VirusTotal Intelligence tag modifier
One of the search modifiers available in VirusTotal Intelligence is "tag". This modifier will search for files tagged with the literal provided. VirusTotal adds tags to all files processed based on hundreds of factors depending on the type of file, information extracted, behaviour, etc.
Here is the full list of tags supported:
32lite | contains-embedded-js | ext-prg | krunchy | overlay | sends-sms |
3gp | contains-macho | ezip | krypton | p | shared-lib |
64bits | contains-msi | f | kryptor | pack200 | shell |
7zip | contains-pe | faulty | l | packman | shellcode |
a | contains-rom | feokpt | lamecrypt | palmos | signed |
ace | contains-zip | file-embedded | latex | pascal | simplepack |
acprotect | copy-file | fla | launch-action | password-dialog | smtp |
acroform | coredump | flac | lcc | pcguard | smtp-communication |
aes-encoded | corrupt | flash | lib | pcshrinker | softdefender |
ahpack | corrupted | flash-embedded | license | software-collection | |
alexprotector | cpp | flc | linux | pe intro | ssh |
alloy | create-dir | fli | lnk | pe-armor | ssh-communication |
android | create-file | flv | loadbytes | pearmor | starforce |
anorganix | create-ole | fortran | long-base64 | pebundle | startup-folder |
anskya | createinstall | fpx | long-hex | pecompact | stealth |
anti-analysis | crinkler | fres | long-sleeps | pecrc32 | stones |
apatch | crunch | freshbind | lzexe | pecrypt32 | sudo |
apfs | crx | fscommand | lzma | pedll | suspicious-dns |
apk | crypkey | fsg | m | peexe | suspicious-eip |
apple | crypt | ftp | mac | penightmare | suspicious-udp |
appledouble | crypto | ftp-communication | mac-app | peninja | svg |
appleplist | cydia | fusion | mac-publisher | pepack | svkprotector |
applesingle | d | g | machfs | peprotect | symbian |
arc | dbpe | gamehouse | macho | perl | system-library |
arj | ddem | gif | maclib | persistence | t |
arm | deb | gimp | macros | peshield | tag |
armadillo | depack | goats | malformed | peshit | tar |
arsc | detect-debug-environment | goodware | malware | pespin | tar-bundle |
asd | dex | gpt | matcho | petite | targa |
asf | diminisher | gul | mew | pex | telephony |
aspack | dingboy | gzip | microjoiner | php | telnet |
asprotect | direct-cpu-clock-access | h | midi | pkg | telnet-communication |
assembly | dmg | hackstop | mmbuilder | pklite | telock |
attachment | doc | handle-file | mobile-substrate | pklite32 | text |
auto-close | docx | hash-collision | molebox | png | themida |
auto-create | domain-pattern | hasp | morphine | polyene | thinstall |
auto-modify | dos-stub | hfs | mp3 | postinst | tiff |
auto-open | download | hide-app | mp4 | postrm | tlpack |
autoaction | dropper | honeypot | mpeg | powershell | trojan |
avi | dxpack | hosts-modifier | mscompress | ppsx | trusted |
awk | dyalog | html | msi | ppt | ttf |
axml | dyn-calls | html-control | multi-arch | pptx | u |
b | dyn-class | hwp | mysql | preinst | uefi |
bambam | dzip | i | mysql-communication | prerm | upack |
base64-embedded | e | ico | mz | ps | upx |
base64-string | ebook | iecookie | n | psd | url-pattern |
beria | efi | iframe | nakedpack | punisher | usb-autorun |
bero | elf | indesign | native | python | vba |
bittorrent | installshield | neexe | qt | vcasm | |
blade | email-pattern | installstub | neolite | r | via-tor |
blob | emf | intel-me | nfo | radpack | virogen |
bmp | empty | invalid-rich-pe-checksum | northstar | rar | wav |
bobsoft | encrypted | invalid-rich-pe-duplicated-entries | npack | rar-embedded | winrar |
bzip | encryptpe | invalid-rich-pe-linker-version | nsis | rcryptor | winzip |
c | enigma | invalid-rich-pe-modified-iat | nspack | reflection | wise |
cab | enum-windows | invalid-signature | nsrl | registry | woff |
calls-wmi | environ | invalid-xref | ntkrnl | relocatable | worm |
cap | eot | ios | nullsoft | repeated-clock-access | write-file |
capabilities | eps | ipbprotect | nxdomain | revoked-cert | wwpack |
cdcops | escargot | iphone | o | rlpack | x |
cexe | exe-embedded | ipv4-pattern | obfuscated | rm | xcr |
checks-disk-space | exe-pattern | irc | obsidium | rom | xls |
checks-gps | exe32pack | isoimage | odex | rpm | xlsx |
checks-network-adapters | execryptor | jar | odg | rtf | xml |
checks-user-input | executes-dropped-file | java | odp | ruby | xorcrypt |
chm | exejoiner | java-bytecode | ods | run-dll | xpi |
clipboard | exelocker | javascript | odt | run-file | xws |
code injection | exepack | jdpack | ogg | runtime-modules | y |
codesafe | exepacker | jng | ole-autolink | rzip | yoda |
coff | exeshield | jpeg | ole-control | s | yodaprot |
com | exesmasher | js-embedded | ole-embedded | save-workbook | yodaprotect |
contains-apk | exestealth | jspack | ole-link | script | zero-filled |
contains-deb | exploit | kbys | open-file | sdprotect | zip |
contains-dmg | exploit-kit | kgb | opendir | sdprotector | zip-embedded |
contains-drv | expressor | kkrunchy | orien | self-delete | zipped |
contains-elf | ext-interface | krnl | outlook | send-keys | zlib |