Back Home
Full list of VirusTotal Intelligence tag modifier
One of the search modifiers available in VirusTotal Intelligence is "tag". This modifier will search for files tagged with the literal provided. VirusTotal adds tags to all files processed based on hundreds of factors depending on the type of file, information extracted, behaviour, etc.
Here is the full list of tags supported:
| 32lite | contains-embedded-js | ext-prg | krunchy | overlay | sends-sms |
| 3gp | contains-macho | ezip | krypton | p | shared-lib |
| 64bits | contains-msi | f | kryptor | pack200 | shell |
| 7zip | contains-pe | faulty | l | packman | shellcode |
| a | contains-rom | feokpt | lamecrypt | palmos | signed |
| ace | contains-zip | file-embedded | latex | pascal | simplepack |
| acprotect | copy-file | fla | launch-action | password-dialog | smtp |
| acroform | coredump | flac | lcc | pcguard | smtp-communication |
| aes-encoded | corrupt | flash | lib | pcshrinker | softdefender |
| ahpack | corrupted | flash-embedded | license | software-collection | |
| alexprotector | cpp | flc | linux | pe intro | ssh |
| alloy | create-dir | fli | lnk | pe-armor | ssh-communication |
| android | create-file | flv | loadbytes | pearmor | starforce |
| anorganix | create-ole | fortran | long-base64 | pebundle | startup-folder |
| anskya | createinstall | fpx | long-hex | pecompact | stealth |
| anti-analysis | crinkler | fres | long-sleeps | pecrc32 | stones |
| apatch | crunch | freshbind | lzexe | pecrypt32 | sudo |
| apfs | crx | fscommand | lzma | pedll | suspicious-dns |
| apk | crypkey | fsg | m | peexe | suspicious-eip |
| apple | crypt | ftp | mac | penightmare | suspicious-udp |
| appledouble | crypto | ftp-communication | mac-app | peninja | svg |
| appleplist | cydia | fusion | mac-publisher | pepack | svkprotector |
| applesingle | d | g | machfs | peprotect | symbian |
| arc | dbpe | gamehouse | macho | perl | system-library |
| arj | ddem | gif | maclib | persistence | t |
| arm | deb | gimp | macros | peshield | tag |
| armadillo | depack | goats | malformed | peshit | tar |
| arsc | detect-debug-environment | goodware | malware | pespin | tar-bundle |
| asd | dex | gpt | matcho | petite | targa |
| asf | diminisher | gul | mew | pex | telephony |
| aspack | dingboy | gzip | microjoiner | php | telnet |
| asprotect | direct-cpu-clock-access | h | midi | pkg | telnet-communication |
| assembly | dmg | hackstop | mmbuilder | pklite | telock |
| attachment | doc | handle-file | mobile-substrate | pklite32 | text |
| auto-close | docx | hash-collision | molebox | png | themida |
| auto-create | domain-pattern | hasp | morphine | polyene | thinstall |
| auto-modify | dos-stub | hfs | mp3 | postinst | tiff |
| auto-open | download | hide-app | mp4 | postrm | tlpack |
| autoaction | dropper | honeypot | mpeg | powershell | trojan |
| avi | dxpack | hosts-modifier | mscompress | ppsx | trusted |
| awk | dyalog | html | msi | ppt | ttf |
| axml | dyn-calls | html-control | multi-arch | pptx | u |
| b | dyn-class | hwp | mysql | preinst | uefi |
| bambam | dzip | i | mysql-communication | prerm | upack |
| base64-embedded | e | ico | mz | ps | upx |
| base64-string | ebook | iecookie | n | psd | url-pattern |
| beria | efi | iframe | nakedpack | punisher | usb-autorun |
| bero | elf | indesign | native | python | vba |
| bittorrent | installshield | neexe | qt | vcasm | |
| blade | email-pattern | installstub | neolite | r | via-tor |
| blob | emf | intel-me | nfo | radpack | virogen |
| bmp | empty | invalid-rich-pe-checksum | northstar | rar | wav |
| bobsoft | encrypted | invalid-rich-pe-duplicated-entries | npack | rar-embedded | winrar |
| bzip | encryptpe | invalid-rich-pe-linker-version | nsis | rcryptor | winzip |
| c | enigma | invalid-rich-pe-modified-iat | nspack | reflection | wise |
| cab | enum-windows | invalid-signature | nsrl | registry | woff |
| calls-wmi | environ | invalid-xref | ntkrnl | relocatable | worm |
| cap | eot | ios | nullsoft | repeated-clock-access | write-file |
| capabilities | eps | ipbprotect | nxdomain | revoked-cert | wwpack |
| cdcops | escargot | iphone | o | rlpack | x |
| cexe | exe-embedded | ipv4-pattern | obfuscated | rm | xcr |
| checks-disk-space | exe-pattern | irc | obsidium | rom | xls |
| checks-gps | exe32pack | isoimage | odex | rpm | xlsx |
| checks-network-adapters | execryptor | jar | odg | rtf | xml |
| checks-user-input | executes-dropped-file | java | odp | ruby | xorcrypt |
| chm | exejoiner | java-bytecode | ods | run-dll | xpi |
| clipboard | exelocker | javascript | odt | run-file | xws |
| code injection | exepack | jdpack | ogg | runtime-modules | y |
| codesafe | exepacker | jng | ole-autolink | rzip | yoda |
| coff | exeshield | jpeg | ole-control | s | yodaprot |
| com | exesmasher | js-embedded | ole-embedded | save-workbook | yodaprotect |
| contains-apk | exestealth | jspack | ole-link | script | zero-filled |
| contains-deb | exploit | kbys | open-file | sdprotect | zip |
| contains-dmg | exploit-kit | kgb | opendir | sdprotector | zip-embedded |
| contains-drv | expressor | kkrunchy | orien | self-delete | zipped |
| contains-elf | ext-interface | krnl | outlook | send-keys | zlib |