Back Home
Full list of VirusTotal Intelligence tag modifier
One of the search modifiers available in VirusTotal Intelligence is "tag". This modifier will search for files tagged with the literal provided. VirusTotal adds tags to all files processed based on hundreds of factors depending on the type of file, information extracted, behaviour, etc.
You can find the description and examples of the most common tags at the File search modifiers article.
Here is the full list of tags supported:
| 32lite | 3gp | 64bits | 7zip | ace |
| acprotect | acroform | aes-encoded | ahpack | alexprotector |
| alloy | android | anorganix | anskya | anti-analysis |
| apatch | apfs | apk | apple | appledouble |
| appleplist | applesingle | arc | arj | arm |
| armadillo | arsc | asd | asf | aspack |
| asprotect | assembly | attachment | auto-close | auto-create |
| auto-modify | auto-open | autoaction | avi | awk |
| axml | bambam | base64-embedded | base64-string | beria |
| bero | bittorrent | blade | blob | bmp |
| bobsoft | bzip | c | cab | calls-wmi |
| cap | capabilities | cdcops | cexe | checks-disk-space |
| checks-gps | checks-network-adapters | checks-user-input | chm | clipboard |
| code injection | codesafe | coff | com | contains-apk |
| contains-deb | contains-dmg | contains-drv | contains-elf | contains-embedded-js |
| contains-macho | contains-msi | contains-pe | contains-rom | contains-zip |
| copy-file | coredump | corrupt | corrupted | cpp |
| create-dir | create-file | create-ole | createinstall | crinkler |
| crunch | crx | crypkey | crypt | crypto |
| cydia | dbpe | ddem | deb | depack |
| detect-debug-environment | dex | diminisher | dingboy | direct-cpu-clock-access |
| dmg | doc | docx | domain-pattern | dos-stub |
| download | dropper | dxpack | dyalog | dyn-calls |
| dyn-class | dzip | ebook | efi | elf |
| email-pattern | emf | empty | encrypted | |
| encryptpe | enigma | enum-windows | environ | eot |
| eps | escargot | exe-embedded | exe-pattern | exe32pack |
| execryptor | executes-dropped-file | exejoiner | exelocker | exepack |
| exepacker | exeshield | exesmasher | exestealth | exploit |
| exploit-kit | expressor | ext-interface | ext-prg | ezip |
| faulty | feokpt | file-embedded | fla | flac |
| flash | flash-embedded | flc | fli | flv |
| fortran | fpx | fres | freshbind | fscommand |
| fsg | ftp | ftp-communication | fusion | gamehouse |
| gif | gimp | goats | goodware | gpt |
| gul | gzip | hackstop | handle-file | hash-collision |
| hasp | hfs | hide-app | honeypot | hosts-modifier |
| html | html-control | hwp | ico | iecookie |
| iframe | indesign | installshield | installstub | intel-me |
| invalid-signature | invalid-xref | ios | ipbprotect | iphone |
| ipv4-pattern | irc | isoimage | jar | java |
| java-bytecode | javascript | jdpack | jng | jpeg |
| js-embedded | jspack | kbys | kgb | kkrunchy |
| known-distributor | krnl | krunchy | krypton | kryptor |
| lamecrypt | latex | launch-action | lcc | lib |
| license | linux | lnk | loadbytes | long-base64 |
| long-hex | long-sleeps | lzexe | lzma | mac |
| mac-app | mac-publisher | machfs | macho | maclib |
| macros | malformed | malware | matcho | mew |
| microjoiner | midi | mmbuilder | mobile-substrate | molebox |
| morphine | mp3 | mp4 | mpeg | mscompress |
| msi | multi-arch | mysql | mysql-communication | mz |
| nakedpack | native | neexe | neolite | nfo |
| northstar | npack | nsis | nspack | ntkrnl |
| nullsoft | nxdomain | obfuscated | obsidium | odex |
| odg | odp | ods | odt | ogg |
| ole-autolink | ole-control | ole-embedded | ole-link | open-file |
| opendir | orien | outlook | overlay | pack200 |
| packman | palmos | pascal | password-dialog | pcguard |
| pcshrinker | pe intro | pe-armor | pearmor | |
| pebundle | pecompact | pecrc32 | pecrypt32 | pedll |
| peexe | penightmare | peninja | pepack | peprotect |
| perl | persistence | peshield | peshit | pespin |
| petite | pex | php | pkg | pklite |
| pklite32 | png | polyene | postinst | postrm |
| powershell | ppsx | ppt | pptx | preinst |
| prerm | ps | psd | punisher | python |
| qt | radpack | rar | rar-embedded | rcryptor |
| reflection | registry | relocatable | repeated-clock-access | revoked-cert |
| rlpack | rm | rom | rpm | rtf |
| ruby | run-dll | run-file | runtime-modules | rzip |
| save-workbook | script | sdprotect | sdprotector | self-delete |
| send-keys | sends-sms | shared-lib | shell | shellcode |
| signed | simplepack | smtp | softdefender | ssh |
| starforce | startup-folder | stealth | stones | sudo |
| suspicious-dns | suspicious-eip | suspicious-udp | svg | svkprotector |
| symbian | system-library | tag | tar | tar-bundle |
| targa | telephony | telnet | telock | text |
| themida | thinstall | tiff | tlpack | trojan |
| ttf | uefi | upack | upx | url-pattern |
| usb-autorun | vba | vcasm | via-tor | virogen |
| wav | winrar | winzip | wise | woff |
| worm | write-file | wwpack | xcr | xls |
| xlsx | xml | xorcrypt | xpi | xws |
| yoda | yodaprot | yodaprotect | zero-filled | zip |
| zip-embedded | zipped | zlib |
List of deprecated tags:
| invalid-rich-pe-checksum | invalid-rich-pe-duplicated-entries | invalid-rich-pe-linker-version |
| invalid-rich-pe-modified-iat | nsrl | trusted |