2

I found the executable in question using VirusTotal "hunting" feature, where one can run Yara rules for the files existing in VT database and match the strings. I downloaded the file, opened it with PEStudio and it turned out to contain very many strings that were email addresses, one of which was the string I looked for in VT: enter image description here

Please note, the number of extracted strings is pretty high.

However, when I opened the executable in IDA, none of these email strings were found. The number of strings was much lower too. But, instead I found, for example, these strings: enter image description here

Does this possibly mean that the emails do not come from a pre-existing list but are generated by the executable?

In addition, I noticed some text file names in the PEStudio's string list, but they were also nowhere to be found in IDA's list. Is there any difference between IDA's and PEStudio (and similar tools') string extraction?

  • 1
    IIRC, by default Ida skips reading resource sections. Use that other software to see if that's where these strings occur. – usr2564301 Jul 17 '18 at 15:13
  • @usr2564301 Why does Ida skip resource sections? I actually found the missing strings among resources when I opened the PE with Resource Hacker, so it seems to be the case. – skooog Jul 18 '18 at 9:34
3

As confirmed in a comment, these strings appear in the Resources section of the executable.

See this image (taken from the related IDA Pro can't view part of the file, which I can see exists WinHEX and adjusted to highlight this option):

That is the option to click

It is likely disabled by default because they are not important to the process of disassembling, and they might be quite large. So this is only (marginally) useful when you are interpreting parts of the disassembly that use resources.

As Ida PRO does not parse common resource formats, it may not be able to show your strings in its "Strings" window, and always list them as raw data. So you may want to prefer to use an external resource viewer anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.