> Concept · 52pojie Build Provenance_

~/packetpursuit $ cat /intel/concepts/52pojie-build-provenance.md

typeconceptcreated2026-06-14updated2026-06-14attributionchinesecracking-forumbuild-artefacts

52pojie Build Provenance

52pojie (吾爱破解, "I Love Cracking") is a prominent Chinese reverse-engineering and software-cracking forum. Malware samples with PDB paths or build artefacts referencing 52pojie may indicate:

  1. Developer origin — the threat actor is an active forum member.
  2. Tool origin — the binary was built with a cracking tool or template distributed on the forum.
  3. Masquerade — the username is deliberately injected into the PDB to misdirect attribution.

Observed artefacts

  • PDB path: C:\Users\52pojie\Desktop\420\bin\Debug\net10.0\win-x64\native\Update.pdb — sample fbc07658...abce15 (ValleyRAT / SilverFox co-label).

Analytical notes

  • The Desktop\420 path suggests a debug build from a local development workstation, not a CI pipeline.
  • net10.0 (preview / nightly SDK) indicates early adoption of unreleased .NET features.
  • No other samples in the current corpus share this provenance.

References

  • valleyrat — family entity with 52pojie-linked sample