#CurrentCulture | Explore Tumblr posts and blogs

siva3155 · 5 years ago

Text

300+ TOP ASP.NET Objective Questions and Answers

ASP.NET Multiple Choice Questions :-

1. Choose the form in which Postback occur A. HTMLForms B. Webforms C. Winforms Ans: Webforms 2. Web.config file is used... A. Configures the time that the server-side codebehind module is called B. To store the global information and variable definitions for the application C. To configure the web server D. To configure the web browser Ans: To store the global information and variable definitions for the application 3. Which of the following object is not an ASP component? A. LinkCounter B. Counter C. AdRotator D. File Access Ans: LinkCounter 4. The first event triggers in an aspx page is. A. Page_Init() B. Page_Load() C. Page_click() Ans: Page_Init() 5. Difference between Response.Write() andResponse.Output.Write(). A. Response.Output.Write() allows you to buffer output B. Response.Output.Write() allows you to write formatted output C. Response.Output.Write() allows you to flush output D. Response.Output.Write() allows you to stream output Ans: Response.Output.Write() allows you to write formatted output 6. Which of the following method must be overridden in a custom control? A. The Paint() method B. The Control_Build() method C. The default constructor D. The Render() method Ans: The Render() method 7. How do we create a FileSystemObject? A. Server.CreateObject("Scripting.FileSystemObject") B. Create("FileSystemObject") C. Create Object:"Scripting.FileSystemObject" D. Server.CreateObject("FileSystemObject") Ans: Server.CreateObject("Scripting.FileSystemObject") 8. Which of the following tool is used to manage the GAC? A. RegSvr.exe B. GacUtil.exe C. GacSvr32.exe D. GacMgr.exe Ans: GacUtil.exe 9. What class does the ASP.NET Web Form class inherit from by default? A. System.Web.UI.Page B. System.Web.UI.Form C. System.Web.GUI.Page D. System.Web.Form Ans: System.Web.UI.Page 10. We can manage states in asp.net application using A. Session Objects B. Application Objects C. Viewstate D. All of the above Ans: All of the above

ASP.NET MCQs 11. Attribute must be set on a validator control for the validation to work. A. ControlToValidate B. ControlToBind C. ValidateControl D. Validate Ans: ControlToValidate 12. Caching type supported by ASP.Net A. Output Caching B. DataCaching C. a and b D. none of the above Ans: a and b 13. What is used to validate complex string patterns like an e-mail address? A. Extended expressions B. Basic expressions C. Regular expressions D. Irregular expressions Ans: Regular expressions 14. File extension used for ASP.NET files. A. .Web B. .ASP C. .ASPX D. None of the above Ans: .ASP 15. An alternative way of displaying text on web page using A. asp:label B. asp:listitem C. asp:button Ans: asp:label 16. Why is Global.asax is used? A. Declare Global variables B. Implement application and session level events C. No use Ans: Implement application and session level events 17. Which of the following is not a member of ADODBCommand object? A. ExecuteScalar B. ExecuteStream C. Open D. ExecuteReader Ans: Open 18. Which DLL translate XML to SQL in IIS? A. SQLISAPI.dll B. SQLXML.dll C. LISXML.dll D. SQLIIS.dll Ans: SQLISAPI.dll 19. Default Session data is stored in ASP.Net. A. StateServer B. Session Object C. InProcess D. all of the above Ans: InProcess 20. Default scripting language in ASP. A. EcmaScript B. VBScript C. PERL D. JavaScript Ans: VBScript 21. How do you get information from a form that is submitted using the "post" method? A. Request.QueryString B. Request.Form C. Response.write D. Response.writeln Ans: Request.Form 22. Which object can help you maintain data across users? A. Application object B. Session object C. Response object D. Server object Ans: Application object 23. Which of the following ASP.NET object encapsulates the state of the client? A. Session object B. Application object C. Response object D. Server object Ans: Session object 24. Which of the following object is used along with application object in order to ensure that only one process accesses a variable at a time? A. Synchronize B. Synchronize() C. ThreadLock D. Lock() Ans: Synchronize() 25. Which of the following control is used to validate that two fields are equal? A. RegularExpressionValidator B. CompareValidator C. equals() method D. RequiredFieldValidator Ans: CompareValidator 26. Mode of storing ASP.NET session A. InProc B. StateServer C. SQL Server D. All of the above Ans: All of the above 27. Which of the following is not the way to maintain state? A. View state B. Cookies C. Hidden fields D. Request object Ans: Request object 28. You can have only one Global.asax file per project. A. Yes B. No Ans: Yes 29. ______________ element in the web.config file to run code using the permissions of a specific user A. element B. element C. element D. element Ans: element 30. __________ is a special subfolder within the windows folder that stores the shared .NET component. A. /bin B. GAC C. Root Ans: GAC 31. Which of the following is the performance attributes of processModel? A. requestQueue limit B. maxWorkerThreads C. maxIdThreads D. All Ans: All 32. Which of the following is faster and consume lesser memory? A. SQLDataReader B. Data Set Ans: SQLDataReader 33. Which of the following is the way to monitor the web application? A. MMC Event viewers B. Performance logs C. Alerts Snap-ins D. ALL Ans: ALL 34. The ________________ property affects how the .Net Framework handles dates, currencies, sorting and formatting issues. A. CurrentUICulture B. CurrentCulture Ans: CurrentCulture 35. Where do we include the user lists for windows authentication? A. B. C. D. Ans: 36. Where do we include the user lists for Form authentication? A. B. C. D. Ans: 37. Which of the following authentication is best suited for a corporate network? A. Windows B. Form C. User D. All Ans: Windows 38. What attributes do you use to hide a public .Net class from COM? A. DLLImport Attributes B. ComVisible attributes C. COM Interop D. All Ans: ComVisible attributes 39. By default, code written with the Debug class is stripped out of release builds. A. Yes B. No Ans: Yes 40. _________ tests make sure that new code does not break existing code. A. Regression tests B. Integration tests C. Unit tests D. Load test Ans: Integration tests 41. The .NET Framework provides a runtime environment called..... ? A. RMT B. CLR C. RCT D. RC Ans: CLR 42. In ASP.NET in form page the object which contains the user name is ______ ? A. Page.User.Identity B. Page.User.IsInRole C. Page.User.Name D. None of the Above Ans: Page.User.Identity 43. Find the term: The .NET framework which provides automatic memory management using a technique called ______________ ? A. Serialization B. Garbage Collection C. Assemblies D. Overriding Ans: Garbage Collection 44. Which of the following denote ways to manage state in an ASP.Net Application? A. Session objects B. Application objects C. ViewState D. All the Above Ans: All the Above 45. What is the base class from which all Web forms inherit? A. Master Page B. Page Class C. Session Class D. None of the Above Ans: Page Class 46. WSDL stands for ___________ ? A. Web Server Description Language B. Web Server Descriptor Language C. Web Services Description Language D. Web Services Descriptor Language Ans: Web Services Description Language 47. Which of the following must be done in order to connect data from some data resource to Repeater control? A. Set the DataSource property B. Call the DataBind method C. Both A. and B. D. None of the Above Ans: Both A. and B. 48. Which of the following is FALSE? A. ASP.NET applications run without a Web Server B. ASP+ and ASP.NET refer to the same thing C. ASP.NET is a major upgrade over ASP D. None of the Above Ans: None of the Above 49. Which of the following transfer execution directly to another page? A. Server.Transfer B. Response.Redirect C. Both A. and B. D. None of the Above Ans: Server.Transfer 50. If one has two different web form controls in a application and if one wanted to know whether the values in the above two different web form control match what control must be used? A. DataList B. GridView C. CompareValidator D. Listview Ans: CompareValidator 51. Which of the following is used to send email message from my ASP.NET page? A. System.Web.Mail.MailMessage B. System.Web.Mail.SmtpMail C. Both A. and B. D. None of the Above Ans: Both A. and B. 52. In my .NET Framework I have threads. Which of the following denote the possible priority level for the threads? A. Normal B. AboveNormal C. Highest D. All the Above Ans: All the Above 53. In .NET the operation of reading metadata and using its contents is known as ______? A. Reflection B. Enumeration C. Binding D. Serialization Ans: Reflection 54. In ASP.NET the section contain which of the following elements? A. B. C. Both A. and B. D. None of the Above Ans: Both A. and B. 55. The type of code found in Code-Behind class is ________ ? A. Server-side code B. Client-side code C. Both A. and B. D. None of the above Ans: Server-side code 56. Common type system is built into which of the following: A. CLR B. RCT C. RCW D. GAC Ans: CLR 57. The actual work process of ASP.NET is taken care by _____________? A. inetinfo.exe B. aspnet_isapi.dll C. aspnet_wp.exe D. None of the Above Ans: aspnet_wp.exe 58. Which of the following allow writing formatted output? A. Response.Write() B. Response.Output.Write() C. Both A. and B. D. None of the Above Ans: Response.Output.Write() 59. Which of the following denote the property in every validation control? A. ControlToValidate property B. Text property C. Both A. and B. D. None of the Above Ans: Both A. and B. 60. How many classes can a single .NET DLL contain? A. One B. Two C. None D. Many Ans: Many 61. Suppose one wants to modify a SOAP message in a SOAP extension then how this can be achieved. Choose the correct option from below: A. One must override the method ReceiveMessage B. One must override the method InitializeMethod C. Both A. and B. D. One must override the method ProcessMessage Ans: One must override the method ReceiveMessage 62. Which of the following can be used to add alternating color scheme in a Repeater control? A. AlternatingItemTemplate B. DataSource C. ColorValidator D. None of the Above Ans: AlternatingItemTemplate 63. Suppose a .NET programmer wants to convert an object into a stream of bytes then the process is called ______________ ? A. Serialization B. Threading C. RCW D. AppDomain Ans: Serialization 64. The technique that allow code to make function calls to .NET applications on other processes and on other machines is A. .NET Threading B. .NET Remoting C. .NET RMT D. None of the above Ans: .NET Threading 65. The namespace within the Microsoft .NET framework which provides the functionality to implement transaction processing is .................... A. System.EnterpriseServices B. System.Security C. System.Diagnostics D. System.Data Ans: A 66. Which of the following method is used to obtain details about information types of assembly? A. GetTypes B. GetType C. Both A. and B. D. None of the Above Ans: Both A. and B. 67. Which of the following is TRUE about Windows Authentication in ASP.NET? A. Automatically determines role membership B. Role membership determined only by user programming C. ASP.NET does not support Windows Authentication D. None of the Above Ans: Automatically determines role membership 68. What tags one need to add within the asp:datagrid tags to bind columns manually? A. Set AutoGenerateColumns Property to false on the datagrid tag B. Set AutoGenerateColumns Property to true on the datagrid tag C. It is not possible to do the operation D. Set AutomaunalColumns Property to true on the datagrid tag Ans: Set AutoGenerateColumns Property to false on the datagrid tag 69. Which method do you invoke on the DataAdapter control to load your generated dataset with data? A. Load ( ) B. Fill( ) C. DataList D. DataBind Ans: Fill( ) 70. In ASP.NET the sessions can be dumped by using A. Session.Dump B. Session.Abandon C. Session.Exit D. None of the Above Ans: Session.Abandon 71. Which of the following languages can be used to write server side scripting in ASP.NET? A. C-sharp B. VB C. C++ D. A and B Ans: D 72. When an .aspx page is requested from the web server, the out put will be rendered to browser in following format. A. HTML B. XML C. WML D. JSP Ans: A 73. The Asp.net server control, which provides an alternative way of displaying text on web page, is A. B. C. Ans: A 74. The first event to be triggered in an aspx page is. A. Page_Load() B. Page_Init() C. Page_click() Ans: B 75. Postback occurs in which of the following forms. A. Winforms B. HTMLForms C. Webforms Ans: C 76. What namespace does the Web page belong in the .NET Framework class hierarchy? A. System.web.UI.Page B. System.Windows.Page C. System.Web.page Ans: A 77. Which method do you invoke on the Data Adapter control to load your generated dataset? A. Fill( ) B. ExecuteQuery( ) C. Read( ) Ans: A 78. How do you register a user control? A. Add Tag prefix, Tag name B. Add Source, Tag prefix C. Add Src, Tagprefix, Tagname Ans: C 79. Which of the following is true? A. User controls are displayed correctly in the Visual Studio .NET Designer B. Custom controls are displayed correctly in VS.Net Designer C. User and Custom controls are displayed correctly in the Visual Studio .NET Designer. Ans: C 80. To add a custom control to a Web form we have to register with. A. TagPrefix B. Name space of the dll that is referenced C. Assemblyname D. All of the above Ans: B 81. Custom Controls are derived from which of the classes A. System.Web.UI.Webcontrol B. System.Web.UI.Customcontrol C. System.Web.UI.Customcontrols.Webcontrol Ans: D 82. How ASP.Net Different from classic ASP? A. Scripting is separated from the HTML, Code is interpreted seperately B. Scripting is separated from the HTML, Code is compiled as a DLL, the DLLs can be executed on server C. Code is separated from the HTML and interpreted Code is interpreted separately Ans: C 83. What's the difference between Response.Write() andResponse.Output.Write()? A. Response.Output.Write() allows you to flush output B. Response.Output.Write() allows you to buffer output C. Response.Output.Write() allows you to write formatted output D. Response.Output.Write() allows you to stream output Ans: B 84. Why is Global.asax is used? A. Implement application and session level events B. Declare Global variables C. No use Ans: C 85. There can be more than 1 machine.config file in a system A. True B. False Ans: A 86. What is the extension of a web user control file? A. .Asmx B. .Ascx C. .Aspx Ans: A 87. Which of the following is true? A. IsPostBack is a method of System.UI.Web.Page class B. IsPostBack is a method of System.Web.UI.Page class C. IsPostBack is a readonly property of System.Web.UI.Page class Ans: B 88. The number of forms that can be added to a aspx page is. A. 1 B. 2 C. 3 D. More than 3 Ans: C 89. How do you manage states in asp.net application A. Session Objects B. Application Objects C. Viewstate D. All of the above Ans: A 90. Which property of the session object is used to set the local identifier? A. SessionId B. LCID C. Item D. Key Ans: D 91. Select the caching type supported by ASP.Net A. Output Caching B. DataCaching C. a and b D. none of the above Ans: B 92. Where is the default Session data is stored in ASP.Net? A. InProcess B. StateServer C. Session Object D. al of the above Ans: C 93. Select the type Processing model that asp.net simulate A. Event-driven B. Static C. Linear D. Topdown Ans: A 94. Does the EnableViewState allows the page to save the users input on a form? A. Yes B. No Ans: A 95. Which DLL translate XML to SQL in IIS? A. SQLISAPI.dll B. SQLXML.dll C. LISXML.dll D. SQLIIS.dll Ans: A 96. What is the maximum number of cookies that can be allowed to a web site? A. 1 B. 10 C. 20 D. More than 30 Ans: A 97. Select the control which does not have any visible interface. A. Datalist B. DropdownList C. Repeater D. Datagrid Ans: C 98. How do you explicitly kill a user session? A. Session.Close( ) B. Session.Discard( ) C. Session.Abandon D. Session.End E. Session.Exit Ans: C 99. Which of the following is not a member of ADODBCommand object? A. ExecuteReader B. ExecuteScalar C. ExecuteStream D. Open E. CommandText Ans: C 100. Which one of the following namespaces contains the definition for IdbConnection? A. System.Data.Interfaces B. System.Data.Common C. System.Data D. System.Data.Connection Ans: D 101. In your ASP.NET web application you want to display a list of clients on a Web page. The client list displays 10 clients at a time, and you require the ability to edit the clients. Which Web control is the best choice for this scenario? A. The DetailsView control B. The Table control C. The GridView control D. The FormView control Ans: The GridView control 102. How to implement authentication via web.config? A. Include the authentication element. B. Include the authorization element. C. Include the identity element. D. Include the deny element. Ans: Include the authorization element. 103. You need to store state data that is accessible to any user who connects to your Web application. Which object should you use? A. Session B. Application C. Response.Cookies D. Response.ViewState Ans: Application 104. Explain the significance of Server .MapPath A. Returns the Virtual Path of the web folder B. Maps the specified virtual path to Physical path C. Returns the physical file path that corresponds to virtual specified path D. All the above Ans: Returns the physical file path that corresponds to virtual specified path 105. ________ element in the web.config file to run code using the permissions of a specific user A. element B. element C. element D. element Ans: element 106. Which of the following is the way to monitor the web application? A. MMC Event viewers B. Performance logs C. Alerts Snap-ins D. ALL Ans: ALL 107. For your ASP.NET web application your graphics designer created elaborate images that show the product lines of your company. Some of graphics of the product line are rectangular, circular, and others are having complex shapes. You need to use these images as a menu on your Web site. What is the best way of incorporating these images into your Web site? A. Use ImageButton and use the x- and y-coordinates that are returned when the user clicks to figure out what product line the user clicked. B. Use the Table, TableRow, and TableCell controls, break the image into pieces that are displayed in the cells, and use the TableCell control’s Click event to identify the product line that was clicked. C. Use the MultiView control and break up the image into pieces that can be displayed in each View control for each product line. Use the Click event of the View to identify the product line that was clicked. D. Use an ImageMap control and define hot spot areas for each of the product lines. Use the PostBackValue to identify the product line that was clicked. Ans: Use an ImageMap control and define hot spot areas for each of the product lines. Use the PostBackValue to identify the product line that was clicked. 108. An ASP.NET page uses a Datagrid displays employee information.The Web application supports a large number of concurrent users, who will be saving data from the grid back to the database. It is important that the Web application doesn't overwhelm the Web Server. A. Disable View State and don't use session state B. Use View State C. Use URL munging D. Disable ViewState and use Session State Ans: Disable View State and don't use session state 109. Which of these data source controls do not implement Caching? A. LinqDataSource B. ObjectDataSource C. SqlDataSource D. XmlDataSource Ans: LinqDataSource 110. Which of the following is the default authentication mode for IIS? A. Anonymous B. Windows C. Basic Authentication D. None Ans: Anonymous 111. When does Garbage collector run? A. When application is running low of memory B. It runs random C. When application is running for more than 15 minutes D. None of the above Ans: When application is running low of memory 112. Which of the following is the way to monitor the web application? A. MMC Event viewers B. Performance logs C. Alerts Snap-ins D. ALL Ans: ALL 113. Which of the following languages are used to write server side scripting in ASP.NET? A. C-sharp B. VB C. Both C-sharp and VB D. C++ Ans: Both C-sharp and VB 114. In which of the following format, output will be rendered to browser When an .aspx page is requested from the web server? A. JSP B. WML C. XML D. HTML Ans: HTML 115. Which of the following is true? A. User controls are displayed correctly in the Visual Studio .NET Designer B. Custom controls are displayed correctly in VS.Net Designer C. User and Custom controls are displayed correctly in the Visual Studio .NET Designer. Ans: Custom controls are displayed correctly in VS.Net Designer 116. How ASP.Net Different from classic ASP? A. Scripting is separated from the HTML, Code is interpreted seperately B. Code is separated from the HTML and interpreted Code is interpreted separately C. Scripting is separated from the HTML, Code is compiled as a DLL, the DLLs can be executed on server Ans: Scripting is separated from the HTML, Code is compiled as a DLL, the DLLs can be executed on server 117. Which property of the session object is used to set the local identifier? A. LCID B. SessionId C. Key D. Item Ans: LCID 118. Which DLL translate XML to SQL in IIS? A. SQLIIS.dll B. SQLXML.dll C. LISXML.dll D. SQLISAPI.dll Ans: SQLISAPI.dll 119. Which of the following does not have any visible interface? A. Datagrid B. Repeater C. DropdownList D. Datalist Ans: Repeater 120. ________ is not a member of ADODBCommand object. A. ExecuteReader B. ExecuteStream C. ExecuteScalar D. CommandText E. Open Ans: Open 121. Which class can be used to create an XML document from scratch? A. XmlConvert B. XmlDocument C. XmlNew D. XmlSettings Ans: XmlDocument 122. Which class can be used to perform data type conversion between .NET data types and XML types? A. XmlType B. XmlCast C. XmlConvert D. XmlSettings Ans: XmlConvert 123. For your ASP.NET web application your graphics designer created elaborate images that show the product lines of your company. Some of graphics of the product line are rectangular, circular, and others are having complex shapes. You need to use these images as a menu on your Web site. What is the best way of incorporating these images into your Web site? A. Use ImageButton and use the x- and y-coordinates that are returned when the user clicks to figure out what product line the user clicked. B. Use the Table, TableRow, and TableCell controls, break the image into pieces that are displayed in the cells, and use the TableCell control’s Click event to identify the product line that was clicked. C. Use the MultiView control and break up the image into pieces that can be displayed in each View control for each product line. Use the Click event of the View to identify the product line that was clicked. D. Use an ImageMap control and define hot spot areas for each of the product lines. Use the PostBackValue to identify the product line that was clicked. Ans: Use an ImageMap control and define hot spot areas for each of the product lines. Use the PostBackValue to identify the product line that was clicked. 124. In your ASP.NET 2.0 web application you want to display an image that is selected from a collection of images. What approach will you use to implementing this? A. Use the ImageMap control and randomly select a HotSpot to show or hide. B. Use the Image control to hold the image and a Calendar control to randomly select a date for each image to be displayed. C. Use the AdServer control and create an XML file with configuration of the control. D. Use an ImageButton control to predict randomness of the image to be loaded based on the clicks of the control. Ans: Use the AdServer control and create an XML file with configuration of the control. 125. Which of the following is a requirement when merging modified data into a DataSet? A. A primary key must be defined on the DataTable objects B. The DataSet schemas must match in order to merge C. The destination DataSet must be empty prior to merging D. A DataSet must be merged into the same DataSet that created it. Ans: A primary key must be defined on the DataTable objects 126. Which Kind Of data we can store in viewstate A. Viewstate can store only serilizable object B. Viewstate can store anything C. Viewstate can store onlys string D. None Ans: Viewstate can store only serilizable object 127. What is/are the predefined TraceListener(s) in ASP.Net A. TextWriterTraceListener B. EventLogTraceListener C. DefaultTraceListener D. All the above 1, 2,3 Ans: All the above 1, 2,3 128. We have defined one page_load event in aspx page and same page_load event in code behind who will run first? A. page_laod event in aspx page B. page_load event in code-behind C. both will run simultaneously D. None Ans: page_load event in code-behind 129. Which of the following represents the best use of the Table, TableRow, and Table-Cell controls? A. To create and populate a Table in Design view B. To create a customized control that needs to display data in a tabular fashion C. To create and populate a Table with images D. To display a tabular result set Ans: To create a customized control that needs to display data in a tabular fashion 130. How to find out what version of ASP.NET I am using on my machine? A. Response.Write(System.Environment.Version.ToString() ); B. Response.Write(Version.ToString() ); C. Response.Write(System.Version.ToString() ); D. not possible Ans: Response.Write(System.Environment.Version.ToString() ); 131. An ASP.NET page uses a Datagrid displays employee information.The Web application supports a large number of concurrent users, who will be saving data from the grid back to the database. It is important that the Web application doesn't overwhelm the Web Server. A. Disable View State and don't use session state B. Use View State C. Use URL munging D. Disable ViewState and use Session State Ans: Disable View State and don't use session state 132. While creating a Web site with the help of Visual Studio 2005 on a remote computer that does not have Front Page Server Extensions installed, which Web site type will you create in Visual Studio 2005? A. HTTP B. File C. FTP D. All of the above Ans: HTTP 133. What’s the difference between Response.Write() and Response.Output.Write()? A. The First one allows you to write formatted output. B. The latter one allows you to write formatted output. C. No Difference D. The latter one allows you to write unformatted output. Ans: The latter one allows you to write formatted output. 134. If I’m developing an application that must accommodate multiple security levels though secure login and my ASP.NET web application is spanned across three web-servers (using round-robin load balancing) what would be the best approach to maintain login-in state for the users? A. Maintain the login state security through a database. B. Maintain the login state security through a Session. C. Maintain the login state security through a View State. D. All of the Above Ans: Maintain the login state security through a database. 135. Where we can assign value to Static read only member variable of a static class? A. Default constructor B. Parameterized constructor C. Global.asax D. On click of button Ans: Default constructor 136. Which of these files takes the web application in offline mode? A. app_offline.html B. app_offline.htm C. appoffline.html D. none of these Ans: app_offline.htm 137. Which of these classes maps to the tag A. HtmlCheckBox B. HtlmInputCheckBox C. HtmlControl D. None Ans: HtlmInputCheckBox 138. In order to prevent a browser from caching a page which of these xstatements should be written? A. Response.Cache.SetNoStore(); B. Response.Cache.SetNoServerCaching(); C. Response.Cache.SetNoCaching(); D. None of these Ans: Response.Cache.SetNoStore(); 139. Which of these data source controls do not implement Caching? A. LinqDataSource B. ObjectDataSource C. SqlDataSource D. XmlDataSource Ans: LinqDataSource 140. By default, ASP.NET store SessionIDs in _________. A. Cookies B. Cache C. Database D. Global variable Ans: Cookies ASP.NET Questions and Answers pdf Download Read the full article

0 notes

terabitweb · 6 years ago

Text

Original Post from Security Affairs Author: Pierluigi Paganini

ZLab Yoroi-Cybaze dissected another attack wave of Ursnif Trojan, aka Gozi ISFB, an offspring of the original Gozi which source code was leaked in 2014. ZLab Yoroi-Cybaze dissected another attack wave of Ursnif Trojan, aka Gozi ISFB, an offspring of the original Gozi which source code was leaked in 2014.

Introduction

A few days ago, the researchers of ZLab Yoroi-Cybaze dissected another attack wave of the infamous Ursnif malware, also known as Gozi ISFB, an offspring of the original Gozi which source code was leaked in 2014. Ursnif/Gozi is active from over a decade and was one of the most active malware listed in 2017 and 2018. Today it constantly reaches several organization across Italy presenting itself in several ways, for instance as a malicious document delivered through email.

The malware has evolved over time and has added functionality, in fact, apart from collecting banking credentials it is also able to collect keystrokes, cryptocurrencies, screenshots, webmail, integrating spyware features together with banking Trojans features.

During their investigations, researchers of ZLab Yoroi-Cybaze intercept a new variant of this malware delivered through malspam campaign towards Italian companies. This latest Ursnif variant shows the same modus operandi: a malicious document in which is embedded an highly obfuscated VBA macro that acts as a first stage dropper.

The Ursnif Threat Evolution

According to Microsoft since its appearance in 2009, Ursnif has shown incredible capabilities to steal users’ credentials, credentials for local webmail, cloud storage, cryptocurrency exchange platforms and e-commerce sites while remaining more stealthiness as possible. It uses many advanced trick to evade several sandboxes environment and today is the most popular malware spreading in the wild. ZLab researchers have studied many samples in the past to profile the techniques used by the malware, to track its evolution and sophistication over time.

Table 1: Ursnif techniques evolution

First analyzed sample backs to January 2018. That Ursnif variant has delivered through a macro document and consist of a few obfuscated stage and a process hollowing injection technique to execute its payload. After a few months, in June 2018, we find evidence that Ursnif was delivered through Necurs Botnet. The latter is one of the most famous botnets known nowadays and it has been used to deliver this Ursnif variant. The hidden link among Necurs and Ursnif has been discovered by ZLab researchers as explained in this link. In December 2018, a first shift is about the implementation of many dropper stages, in order to hide the final payload; moreover, in order to execute its payload, the malware does not perform a classical process injection as in the previous samples but an APC injection, not yet seen as payload injection trick used by Ursnif.

The sample spread in February 2019 use two new features: the first one is a several obfuscated powershell stages in order to evade AVs and reduce its detection, the second one is the use of steganography technique. The latter permit to hide code into a legit image manipulating specific bits. Next, another code perform a decryption and execution of malicious code into the victim machine.

In March 2019 another weaponized variant of Ursnif has been detected: in this case, to spread the malicious software, a google drive document combined with an obfuscated VBA Script is used over steganography. The last sample shown in previous table is similar to February’s sample but include another interesting feature: in this case a first VBS stage is encrypted using the Vigenere cipher; this allow to hide its malicious code and evade many sandboxes environment. We are observing a continuous evolution due to several features added in few months, this is an indicator that this malware is still in development and, observing also features fragmentation among variants lets us think, with high confidence, that there are various fork of the same codebase spreading in the wild.

Technical Analysis

Sha 256 34669dde1e33ec96147540433f60e90056d38df1e3bb952fdc600e979d74f690 Threat Ursnif dropper Descrizione Breve Excel with macro ssdeep 1536:hn1DN3aMePUKccCEW8yjJTdrBX/3t4k3hOdsylKlgryzc4bNhZFGzE+cL4LgldAK:hn1DN3aM+UKc

Table 2: information about Ursnif dropper

The most widespread infection vector observed were the macro enabled office documents, and this variant uses the same technique too. The malicious document looks like an invoice that requires enabling macros in order to proper view its contents.

Figure 1: excel document requiring macro enabling

The whole infection chain begins when the macro is enabled. This Ursnif variant presents a macro protection technique technique that it’s not present in previous variants, in order to make the analysis hard avoiding manipulation and extraction. After extraction of OLE object inside the document we are able to see the content of macros and their associated name, as shown in the following figure:

Figure 2: macros isolation

Now it is possible to isolate an interesting macro in order to further analyze it in detail. It contains a piece of VBA that was extracted.

Figure 3: VB macro source code

In a different way than the past waves, the malware author added a “VigenereDo” function to decrypt and reconstruct the initial infection step, using an algorithm based on the Vigenère cipher, a classical polyalphabetic cipher.

The resulting command text is obtained combining the obfuscated strings defined in “jeneric” function with other strings (not visible in figure) and after further some manipulations is possible to spot the whole script will be executed. When user enable macros, the “wmic.exe” process run the following code through the “wmic ‘PRocesS’ “Call” ‘CREATe’” command.

Figure 4: the powershell script (crypted)

So, at this point, several powershell deobfuscation steps occurs. First of all, every value (“${1F}”) defined in the ps string is replaced with content stored into “$1F” variable corresponding to “,” (comma) character. After having replaced these values, the script is run through “iex” primitive invoked by “.($psHomE[4]+$pshOMe[34]+’X’)” and next through “( “. ( `$ShELLid[1]+`$shelLID[13]+’X’)”. The complete deobfuscated script is the following.

Figure 5: the first powershell script (decrypted)

Figure 6: image with malicious embedded powershell script

First of all the malware checks the current TimeZone in order to verify if it is set on +01:00. If true, it download the next stage from “hxxps://i[.]imgur[.]com/TVkWKQa[.]png”. As well as in other recent attacks, the downloaded image hides another powershell stage leveraging steganography techniques.

The malware code iterates over each pixel of the image and through several mathematical binary operation converts grabs the two Least Significant Bits of every byte of the picture, concatenating them with other LSBs to produce a complete Powershell code.

Figure 7: second powershell script extracted from the steganographic image

Et voilà, another URL is found but, before download the next stage from it, the malware perform a further checking in order to evaluate the value returned by “CurrentCulture”.

Figure 8: CurrentCulter verification in powershell

If check is verified, once again through the “IEX” primitive it try to download other components named “ose000000.exe” from “hxxps://nuovalo[.]site/RGI82B3.-tmp-tmp”, saving it into “%TEMP%” folder. In the following table are shown the information about sample.

Sha 256 0f2245eec921949d9a1d8e13cab747a7fbb137aaee3b9ddacee0681c8b2e4fa8 Threat Ursnif Descrizione Breve Final payload of Ursnif banking malware ssdeep 6144:LCLAh6EzJYJtmavTXyulcNcyuo8PGJMewXo79y:L54EzetmCb3cNc3o0PR4

Table 3: information about Ursnif final payload

Conclusion

This latest Ursnif wave keeps showing a complex infection process. The starting point of the entire chain was the usual Visual Basic macro, this time protecting its code with a Vigenère cipher, responsible of the decryption of the additional Powershell stage launched abusing the Windows Management Infrastructure (WMI) functionalities, decoupling it to the original infection tree and then completing the infection chain exploiting steganography techniques to bypass network detection and several environmental check, to ensure the malware is running into expected machines confirming the highly evasive trend of this aggressive malware threat.

Further technical details, including Indicators of Compromise, are reported in the analysis published on the Yoroi blog.

Ursnif: The Latest Evolution of the Most Popular Banking Malware

window._mNHandle = window._mNHandle || {}; window._mNHandle.queue = window._mNHandle.queue || []; medianet_versionId = "3121199";

try { window._mNHandle.queue.push(function () { window._mNDetails.loadTag("762221962", "300x250", "762221962"); }); } catch (error) {}

Pierluigi Paganini

(SecurityAffairs – Ursnif Trojan, cybercrime)

The post Ursnif: The Latest Evolution of the Most Popular Banking Malware appeared first on Security Affairs.

#gallery-0-6 { margin: auto; } #gallery-0-6 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-6 img { border: 2px solid #cfcfcf; } #gallery-0-6 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: Pierluigi Paganini Ursnif: The Latest Evolution of the Most Popular Banking Malware Original Post from Security Affairs Author: Pierluigi Paganini ZLab Yoroi-Cybaze dissected another attack wave of Ursnif Trojan, aka Gozi ISFB, an offspring of the original Gozi which source code was leaked in 2014.

#Security Affairs blog

0 notes