Back Home
Full list of VirusTotal Intelligence tag modifier
One of the search modifiers available in VirusTotal Intelligence is "tag". This modifier will search for files tagged with the literal provided. VirusTotal adds tags to all files processed based on hundreds of factors depending on the type of file, information extracted, behaviour, etc.
Here is the full list of tags supported:
| 32lite | 64bits | 7zip | acprotect |
| acroform | ahpack | alexprotector | alloy |
| android | anorganix | anskya | anti-analysis |
| anywhere | apatch | apex | apple |
| appledouble | appleplist | applesingle | armadillo |
| arsc | aspack | asprotect | assembly |
| attachment | auto-close | auto-create | auto-modify |
| auto-open | autoaction | axml | beria |
| bero | bittorrent | blackhole | blade |
| blob | bobsoft | bzip | capabilities |
| cdcops | cexe | checks-gps | code injection |
| codelock | codesafe | coff | compack |
| contains-deb | contains-drv | contains-elf | contains-macho |
| contains-pe | contains-rom | copy-file | copycontrol |
| coredump | corrupt | create-dir | create-file |
| create-ole | createinstall | crinkler | crunch |
| crypkey | crypt | cryptz | crypwrap |
| cydia | dbpe | ddem | dell-pfs |
| depack | diminisher | dingboy | diprotector |
| djoin | docx | domain-pattern | dos-stub |
| download | dropper | dshield | dual |
| dxpack | dyalog | dyn-calls | dyn-class |
| dzip | ebook | email-pattern | |
| email-spam | embedpe | empty | encrypted |
| encryptpe | enigma | enum-windows | environ |
| escargot | exe-embedded | exe-pattern | exe32pack |
| execryptor | exejoiner | exelocker | exepack |
| exepacker | exeshield | exesmasher | exestealth |
| exploit | exploit-kit | expressor | ext-interface |
| ext-prg | ezip | faulty | feokpt |
| file-embedded | fixuppak | flac | flash |
| flash-embedded | fortran | fres | freshbind |
| frusion | fscommand | fusion | gamehouse |
| gimp | gleam | goats | goodware |
| gzip | hackstop | handle-file | hash-collision |
| hasp | heap-spray | hide-app | honeypot |
| hosts-modifier | html | html-control | iecookie |
| iframe | indesign | installshield | installstub |
| intel-me | invalid-signature | invalid-xref | ipbprotect |
| iphone | ipv4-pattern | isoimage | java |
| java-bytecode | jdpack | jpeg | js-embedded |
| jspack | kbys | kkrunchy | krnl |
| krunchy | krypton | kryptor | lamecrypt |
| latex | launch-action | license | linux |
| loadbytes | lockless | long-hex | lzexe |
| lzma | mac-app | mac-publisher | machfs |
| macho | macros | malware | matcho |
| microjoiner | midi | mmbuilder | mobile-substrate |
| molebox | morphine | mpeg | mscompress |
| multi-arch | mysql | mz0ope | nakedpack |
| native | neexe | neolite | niceprotect |
| noodlecrypt | northstar | npack | nsis |
| nspack | nsrl | ntkrnl | nullsoft |
| nxdomain | obfuscated | obsidium | odex |
| ole-autolink | ole-control | ole-embedded | ole-link |
| open-file | orien | os-checking | outlook |
| overlay | pack200 | packanoid | packman |
| palmos | pascal | pcguard | pcshrinker |
| pe intro | pe-armor | pearmor | pebundle |
| pecompact | pecrc32 | pecrypt32 | pedll |
| peexe | pelock | penightmare | peninja |
| pepack | peprotect | perl | peshield |
| peshit | pespin | petite | pklite |
| pklite32 | polyene | postinst | postrm |
| powershell | ppsx | pptx | preinst |
| prerm | punisher | python | radpack |
| rar-embedded | rcryptor | registry | relocatable |
| reversinglabs | revoked-cert | rlpack | ruby |
| run-dll | run-file | rzip | save-workbook |
| script | sdprotect | sdprotector | send-keys |
| sends-sms | shared-lib | shell | shellcode |
| signed | simplepack | smtp | softdefender |
| software-collection | starforce | startup-folder | stealth |
| stones | suspicious-dns | suspicious-eip | suspicious-udp |
| svkprotector | symbian | tar-bundle | targa |
| telnet | telock | text | themida |
| thinstall | tiff | tlpack | trojan |
| trusted | uefi | upack | url-pattern |
| usb-autorun | vcasm | via-tor | virogen |
| webcops | winrar | winzip | wise |
| woff | worm | write-file | wwpack |
| xlsx | xorcrypt | yoda | yodaprot |
| yodaprotect | zcode | zero-filled | zip-embedded |
| zipped | zlib |