Full list of VirusTotal Intelligence tag modifier
One of the search modifiers available in VirusTotal Intelligence is "tag". This modifier will search for files tagged with the literal provided. VirusTotal adds tags to all files processed based on hundreds of factors depending on the type of file, information extracted, behaviour, etc.
You can find the description and examples of the most common tags at the File search modifiers article.
Here is the full list of tags supported:
32lite | 3gp | 64bits | 7zip | ace |
acprotect | acroform | aes-encoded | ahpack | alexprotector |
alloy | android | anorganix | anskya | anti-analysis |
apatch | apfs | apk | apple | appledouble |
appleplist | applesingle | arc | arj | arm |
armadillo | arsc | asd | asf | aspack |
asprotect | assembly | attachment | auto-close | auto-create |
auto-modify | auto-open | autoaction | avi | awk |
axml | bambam | base64-embedded | base64-string | beria |
bero | bittorrent | blade | blob | bmp |
bobsoft | bzip | c | cab | calls-wmi |
cap | capabilities | cdcops | cexe | checks-disk-space |
checks-gps | checks-network-adapters | checks-user-input | chm | clipboard |
code injection | codesafe | coff | com | contains-apk |
contains-deb | contains-dmg | contains-drv | contains-elf | contains-embedded-js |
contains-macho | contains-msi | contains-pe | contains-rom | contains-zip |
copy-file | coredump | corrupt | corrupted | cpp |
create-dir | create-file | create-ole | createinstall | crinkler |
crunch | crx | crypkey | crypt | crypto |
cydia | dbpe | ddem | deb | depack |
detect-debug-environment | dex | diminisher | dingboy | direct-cpu-clock-access |
dmg | doc | docx | domain-pattern | dos-stub |
download | dropper | dxpack | dyalog | dyn-calls |
dyn-class | dzip | ebook | efi | elf |
email-pattern | emf | empty | encrypted | |
encryptpe | enigma | enum-windows | environ | eot |
eps | escargot | exe-embedded | exe-pattern | exe32pack |
execryptor | executes-dropped-file | exejoiner | exelocker | exepack |
exepacker | exeshield | exesmasher | exestealth | exploit |
exploit-kit | expressor | ext-interface | ext-prg | ezip |
faulty | feokpt | file-embedded | fla | flac |
flash | flash-embedded | flc | fli | flv |
fortran | fpx | fres | freshbind | fscommand |
fsg | ftp | ftp-communication | fusion | gamehouse |
gif | gimp | goats | goodware | gpt |
gul | gzip | hackstop | handle-file | hash-collision |
hasp | hfs | hide-app | honeypot | hosts-modifier |
html | html-control | hwp | ico | iecookie |
iframe | indesign | installshield | installstub | intel-me |
invalid-signature | invalid-xref | ios | ipbprotect | iphone |
ipv4-pattern | irc | isoimage | jar | java |
java-bytecode | javascript | jdpack | jng | jpeg |
js-embedded | jspack | kbys | kgb | kkrunchy |
known-distributor | krnl | krunchy | krypton | kryptor |
lamecrypt | latex | launch-action | lcc | lib |
license | linux | lnk | loadbytes | long-base64 |
long-hex | long-sleeps | lzexe | lzma | mac |
mac-app | mac-publisher | machfs | macho | maclib |
macros | malformed | malware | matcho | mew |
microjoiner | midi | mmbuilder | mobile-substrate | molebox |
morphine | mp3 | mp4 | mpeg | mscompress |
msi | multi-arch | mysql | mysql-communication | mz |
nakedpack | native | neexe | neolite | nfo |
northstar | npack | nsis | nspack | ntkrnl |
nullsoft | nxdomain | obfuscated | obsidium | odex |
odg | odp | ods | odt | ogg |
ole-autolink | ole-control | ole-embedded | ole-link | open-file |
opendir | orien | outlook | overlay | pack200 |
packman | palmos | pascal | password-dialog | pcguard |
pcshrinker | pe intro | pe-armor | pearmor | |
pebundle | pecompact | pecrc32 | pecrypt32 | pedll |
peexe | penightmare | peninja | pepack | peprotect |
perl | persistence | peshield | peshit | pespin |
petite | pex | php | pkg | pklite |
pklite32 | png | polyene | postinst | postrm |
powershell | ppsx | ppt | pptx | preinst |
prerm | ps | psd | punisher | python |
qt | radpack | rar | rar-embedded | rcryptor |
reflection | registry | relocatable | repeated-clock-access | revoked-cert |
rlpack | rm | rom | rpm | rtf |
ruby | run-dll | run-file | runtime-modules | rzip |
save-workbook | script | sdprotect | sdprotector | self-delete |
send-keys | sends-sms | shared-lib | shell | shellcode |
signed | simplepack | smtp | softdefender | ssh |
starforce | startup-folder | stealth | stones | sudo |
suspicious-dns | suspicious-eip | suspicious-udp | svg | svkprotector |
symbian | system-library | tag | tar | tar-bundle |
targa | telephony | telnet | telock | text |
themida | thinstall | tiff | tlpack | trojan |
ttf | uefi | upack | upx | url-pattern |
usb-autorun | vba | vcasm | via-tor | virogen |
wav | winrar | winzip | wise | woff |
worm | write-file | wwpack | xcr | xls |
xlsx | xml | xorcrypt | xpi | xws |
yoda | yodaprot | yodaprotect | zero-filled | zip |
zip-embedded | zipped | zlib |
List of deprecated tags:
invalid-rich-pe-checksum | invalid-rich-pe-duplicated-entries | invalid-rich-pe-linker-version |
invalid-rich-pe-modified-iat | nsrl | trusted |