A Mega Malware Analysis Tutorial Featuring Donut-Generated Shellcode
Summary: Unit 42 published a beginner-friendly malware analysis tutorial that walks through a single infection chain end to end, from the initial sample through the final payload, using shellcode generated by a tool called Donut. The preview excerpt analyzes an unknown function, sub_10A31A, in IDA Pro and x64dbg, showing how a call $+5 sequence pushes an address onto the stack and subtracts 5 to implement PC-relative addressing so the shellcode stays position-independent.
What's compelling: The technique shown is the same one that lets shellcode locate its own resources without the relocation a PE loader would apply, which is why it can run from memory and evade controls built around file-based execution. Unit 42 also shared these findings with Cyber Threat Alliance members so they could deploy protections to their customers.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026