Why can I see certain strings when PE is opened with a hex editor or a simple static analysis tool but not with IDA?

Question

I found the executable in question using VirusTotal "hunting" feature, where one can run Yara rules for the files existing in VT database and match the strings. I downloaded the file, opened it with PEStudio and it turned out to contain very many strings that were email addresses, one of which was the string I looked for in VT:

Please note, the number of extracted strings is pretty high.

However, when I opened the executable in IDA, none of these email strings were found. The number of strings was much lower too. But, instead I found, for example, these strings:

Does this possibly mean that the emails do not come from a pre-existing list but are generated by the executable?

In addition, I noticed some text file names in the PEStudio's string list, but they were also nowhere to be found in IDA's list. Is there any difference between IDA's and PEStudio (and similar tools') string extraction?

Answer 1

As confirmed in a comment, these strings appear in the Resources section of the executable.

See this image (taken from the related IDA Pro can't view part of the file, which I can see exists WinHEX and adjusted to highlight this option):

It is likely disabled by default because they are not important to the process of disassembling, and they might be quite large. So this is only (marginally) useful when you are interpreting parts of the disassembly that use resources.

As Ida PRO does not parse common resource formats, it may not be able to show your strings in its "Strings" window, and always list them as raw data. So you may want to prefer to use an external resource viewer anyway.