Back Home
Full list of VirusTotal Intelligence tag modifier
One of the search modifiers available in VirusTotal Intelligence is "tag". This modifier will search for files tagged with the literal provided. VirusTotal adds tags to all files processed based on hundreds of factors depending on the type of file, information extracted, behaviour, etc.
Here is the full list of tags supported:
| 32lite | 64bits | 7zip | acprotect |
| acroform | ahpack | alexprotector | alloy |
| android | anorganix | anskya | anti-analysis |
| anywhere | apatch | apex | apple |
| appledouble | appleplist | applesingle | armadillo |
| arsc | aspack | asprotect | assembly |
| attachment | auto-close | auto-create | auto-modify |
| auto-open | autoaction | axml | beria |
| bero | bittorrent | blackhole | blade |
| blob | bobsoft | bzip | capabilities |
| cdcops | cexe | checks-gps | code injection |
| codelock | codesafe | coff | compack |
| contains-deb | contains-drv | contains-elf | contains-macho |
| contains-pe | contains-rom | copy-file | copycontrol |
| coredump | corrupt | create-dir | create-file |
| create-ole | createinstall | crinkler | crunch |
| crypkey | crypt | cryptz | crypwrap |
| cydia | dbpe | ddem | dell-pfs |
| depack | diminisher | dingboy | diprotector |
| djoin | docx | domain-pattern | dos-stub |
| download | dropper | dshield | dual |
| dxpack | dyalog | dyn-calls | dyn-class |
| dzip | ebook | email-pattern | |
| email-spam | embedpe | empty | encrypted |
| encryptpe | enigma | enum-windows | environ |
| escargot | exe-embedded | exe-pattern | exe32pack |
| execryptor | exejoiner | exelocker | exepack |
| exepacker | exeshield | exesmasher | exestealth |
| exploit | exploit-kit | expressor | ext-interface |
| ext-prg | ezip | faulty | feokpt |
| file-embedded | fixuppak | flac | flash |
| flash-embedded | fortran | fres | freshbind |
| frusion | fscommand | fusion | gamehouse |
| gimp | gleam | goats | goodware |
| gzip | hackstop | handle-file | hash-collision |
| hasp | heap-spray | hide-app | honeypot |
| hosts-modifier | html | html-control | iecookie |
| iframe | indesign | installshield | installstub |
| intel-me | invalid-signature | invalid-xref | ipbprotect |
| iphone | ipv4-pattern | isoimage | java |
| java-bytecode | jdpack | jpeg | js-embedded |
| jspack | kbys | kkrunchy | krnl |
| krunchy | krypton | kryptor | lamecrypt |
| latex | launch-action | license | linux |
| lnk | loadbytes | lockless | long-hex |
| lzexe | lzma | mac-app | mac-publisher |
| machfs | macho | macros | malware |
| matcho | microjoiner | midi | mmbuilder |
| mobile-substrate | molebox | morphine | mpeg |
| mscompress | multi-arch | mysql | mz0ope |
| nakedpack | native | neexe | neolite |
| niceprotect | noodlecrypt | northstar | npack |
| nsis | nspack | nsrl | ntkrnl |
| nullsoft | nxdomain | obfuscated | obsidium |
| odex | ole-autolink | ole-control | ole-embedded |
| ole-link | open-file | orien | os-checking |
| outlook | overlay | pack200 | packanoid |
| packman | palmos | pascal | pcguard |
| pcshrinker | pe intro | pe-armor | pearmor |
| pebundle | pecompact | pecrc32 | pecrypt32 |
| pedll | peexe | pelock | penightmare |
| peninja | pepack | peprotect | perl |
| peshield | peshit | pespin | petite |
| pklite | pklite32 | polyene | postinst |
| postrm | powershell | ppsx | pptx |
| preinst | prerm | punisher | python |
| radpack | rar-embedded | rcryptor | registry |
| relocatable | reversinglabs | revoked-cert | rlpack |
| ruby | run-dll | run-file | rzip |
| save-workbook | script | sdprotect | sdprotector |
| send-keys | sends-sms | shared-lib | shell |
| shellcode | signed | simplepack | smtp |
| softdefender | software-collection | starforce | startup-folder |
| stealth | stones | suspicious-dns | suspicious-eip |
| suspicious-udp | svkprotector | symbian | tar-bundle |
| targa | telnet | telock | text |
| themida | thinstall | tiff | tlpack |
| trojan | trusted | uefi | upack |
| url-pattern | usb-autorun | vcasm | via-tor |
| virogen | webcops | winrar | winzip |
| wise | woff | worm | write-file |
| wwpack | xlsx | xorcrypt | yoda |
| yodaprot | yodaprotect | zcode | zero-filled |
| zip-embedded | zipped | zlib |