Reason Labs

yoursites123.xml

The file yoursites123.xml has been detected as PUP.Search.Hijacker. This is a Mozilla Firefox web browser search plugin called ‘yoursites123’ which enables the search engine provider as well as search suggestions.
MD5:
043d26b6f7190193ec6ab38bf14839c3

SHA-1:
362b4659f56cf7a9aece1e4defc5d91aaf73fc47

SHA-256:
80bb360d8aee625026adb8fc0d245e09d9eabed8c1378ef8e0b690b4b8982811

Detection:
PUP.Search.Hijacker

Risk:
Medium

Explanation:
This potentially unwanted yoursites123 search plugin for Firefox is used to direct web searches from the search bar and runs as the browser's search engine.

Analysis date:
10/19/2018 4:04:47 AM UTC  (today)

File size:
638 Bytes

File type:
OpenSearch plugin for Firefox

Common path:
C:\users\{user}\appdata\roaming\mozilla\firefox\profiles\{user}.default\searchplugins\yoursites123.xml

Mozilla Search Plugins
Name:
yoursites123

Description:
yoursites123 Search

Search Form:
http://yoursites123.com/web/

Search Template:
http://yoursites123.com/web


<SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">
  <ShortName>yoursites123</ShortName>
  <Description>yoursites123 Search</Description>
  <InputEncoding>ISO-8859-1</InputEncoding>
  <Url type="text/html" method="GET" template="http://yoursites123.com/web">
    <Param name="from" value="wpm0314" />
    <Param name="uid" value="ST1000LM024XHN-M101MBB_S30YJ9BF411690" />
    <Param name="ts" value="1458738893" />
    <Param name="z" value="00e3678ac2306cec01168acg8z4wcb5q5tbw6mfgdq" />
    <Param name="type" value="ds" />
    <Param name="q" value="{searchTerms}" />
  </Url>
  <SearchForm>http://yoursites123.com/web/</SearchForm>
</SearchPlugin>
Download Reason Core Security - Powerful anti-malware software