{"id":736,"date":"2020-11-26T18:44:06","date_gmt":"2020-11-26T18:44:06","guid":{"rendered":"https:\/\/cybersecthreat.com\/?p=736"},"modified":"2024-04-01T13:48:39","modified_gmt":"2024-04-01T05:48:39","slug":"dump-password-from-exe-part2","status":"publish","type":"post","link":"https:\/\/cybersecthreat.com\/zh\/2020\/11\/26\/dump-password-from-exe-part2\/","title":{"rendered":"Dump password from exe(2)"},"content":{"rendered":"

This article is actually part two of “Extract\/Dump password from exe” series. In part one<\/a>, we focused on unpacking executable generated by script converter such as PyInstaller, Py2exe and AutoIt. In short, we will focus on executable compiled by Visual Studio and Delphi in this article. Basically, we will try to understand what information is available in the executable file via strings.exe<\/strong>. Although more and more developers are moving to Visual Studio today, but we still saw some applications and malware written by Delphi. Therefore, we will also cover Delphi in our discussion.<\/p>\n\n\n\n

Why is it important?<\/h2>\n\n\n\n

If you are red team player, this article gives you an expectation what information (e.g. credential) is available in the executable file. In addition, traditional anti-virus relies on recognize the signature (keyword). If we have better understand of the relationship between source code and compiled executable, this certainly enhance the ability to evade the defense technology.<\/p>\n\n\n\n

On the other hand, if you are blue team player, you may review with the developer before the credential information leak to wrong hand. Moreover, when performing initial malware analysis, you may also have correct expectation to evaluate the executable file.<\/p>\n\n\n