> Concept · trif32-caesar-shift-23-decoder_

~/packetpursuit $ cat /intel/concepts/trif32-caesar-shift-23-decoder.md

typeconceptcreated2026-07-07updated2026-07-16decodercaesar-cipherdotnetobfuscationcourseworkbenign

A trivial character-shift decoder (Caesar cipher with shift=23, equivalent to ROT-23 or shift backward by 3) embedded in multiple .NET Framework educational applications and games. Named after the class identifier Trif32 observed in CIL metadata. The decoder is benign — a standard programming exercise — but its presence across repackaged samples serves as a cluster fingerprint.

Mechanism

The decoder takes a string and shifts each character by a fixed offset (typically 23 positions forward in ASCII, or 3 positions backward). No key derivation, no XOR, no permutation. The implementation is usually a single static method in a Trif32 class.

// Typical implementation pattern (reconstructed from CIL)
public static string Decode(string input)
{
    char[] output = new char[input.Length];
    for (int i = 0; i < input.Length; i++)
    {
        output[i] = (char)(input[i] + 23);  // or -3
    }
    return new string(output);
}

Known Host Applications

The Trif32 class appears in the following benign .NET applications that have been repackaged with social-engineering filenames:

Sample Application Namespace Distribution Filename
c4ee3a31081d PrimeraVentana Spanish educational app PrimeraVentana HAWB_#4532222.exe
cae7ac1dc419 PrimeraVentana Spanish educational app PrimeraVentana TRANSACTION_ERROR.PDF.exe
a42443c8 PrimeraVentana Spanish educational app PrimeraVentana University__of_Bahrain...exe
6a53c56172ce PrimeraVentana Spanish educational app PrimeraVentana 20240920060544041.exe
92de8242 GoldenCity Spanish city-building game GoldenCity PO-000002168.pdf.exe
6bc4e16d MyPaint.Editor vector drawing MyPaint.Editor PURCHASE_ORDER-6350.exe
6d114209 Ivanov_WF_Paint paint editor Ivanov_WF_Paint
724d94aa AdvWinProgHW2 calculator AdvWinProgHW2
7b3ef687 Pizzaria_Management_VIEW POS/CRM Pizzaria_Management_VIEW
4cce5506 Checkers/draughts game Windows_User_Interaction
0d3d6bb9 Second sibling of checkers game Windows_User_Interaction
4d780fea Hadouken inventory CRUD app Hadouken
5335da6d WinForms paint editor (Paint namespace) Paint
7b3ef687 Pizzaria_Management_VIEW POS/CRM
5ea6b79d Pizzaria_Management_VIEW POS/CRM (stolen Tatham cert)
000d931f Pizzaria_Management_VIEW POS/CRM (third sibling)
54956960 WinForms picture-viewer lab (Lab4CSharp namespace)

Threat Assessment

The decoder itself is not malicious. It is a common introductory programming exercise in Spanish and Brazilian Portuguese computer-science curricula. Its presence in a binary is a strong indicator that the payload is benign coursework or a student project, not active crimeware.

The threat vector is social-engineering masquerade: benign applications repackaged with deceptive filenames and version-info to trick victims into executing them.

Detection

YARA rule — Trif32 class fingerprint

rule dotnet_trif32_decoder_fingerprint
{
    meta:
        description = "Detects .NET binaries containing Trif32 Caesar-shift decoder class"
        author = "PacketPursuit"
        date = "2026-07-07"
    strings:
        $a = "Trif32" ascii wide
        $b = "PrimeraVentana" ascii wide
        $c = "GoldenCity" ascii wide
        $d = "MyPaint.Editor" ascii wide
        $e = "Ivanov_WF_Paint" ascii wide
        $f = "AdvWinProgHW2" ascii wide
        $g = "Pizzaria_Management_VIEW" ascii wide
        $h = "Windows_User_Interaction" ascii wide
        $i = "Hadouken" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.imports("mscoree.dll", "_CorExeMain") and
        $a and any of ($b, $c, $d, $e, $f, $g, $h, $i)
}

Related