I found the executable in question using
VirusTotal "hunting" feature, where one can run
Yara rules for the files existing in VT database and match the strings. I downloaded the file, opened it with
PEStudio and it turned out to contain very many strings that were email addresses, one of which was the string I looked for in VT:
Please note, the number of extracted strings is pretty high.
Does this possibly mean that the emails do not come from a pre-existing list but are generated by the executable?
In addition, I noticed some text file names in the
PEStudio's string list, but they were also nowhere to be found in
IDA's list. Is there any difference between
PEStudio (and similar tools') string extraction?