Home > Threat descriptions >



Category: Malware

Type: Trojan

Platform: SymbOS

Aliases: Trojan:SymbOS/Singlejump.A, SymbOS/Singlejump.A


Trojan:SymbOS/Singlejump.A affects devices running the Symbian S60 operating system. It is distributed in a malicious SIS file named 'PhotoID.v3.06_NEW_7610_3230_6630_SMPDA.sis'.

On execution, the trojan installs small component into locations where it replaces system and third party applications; if these applications are launched, the component resets the device.

Singlejump.A also installs a modified Bluetooth-Worm:SymbOS/Cabir variant that it uses to spread Trojan:SymbOS/Bootton.A to nearby Bluetooth-accessible devices; the modified Cabir is not started automatically but will start when device boots.


Disinfection with two Series 60 phones

Download the F-Skulls tool either onto a computer or directly to the phone :

  • Install F-Skulls.sis into infected phones memory card with a clean phone
  • Put the memory card with F-Skulls into infected phone
  • Start up the infected phone, the application menu should work now
  • Press menu button until you get Symbian process menu, look for any applications with heart icon. Kill the application processes with 'C' button.
  • Go to application manager and uninstall the SIS file in which you installed the Singlejump.A
  • Download F-Secure Mobile Anti-Virus from http://phoneav.com and activate the Anti-Virus
  • Scan the phone and remove any remaining components of Singlejump.A
  • Remove the F-Skulls with application manager as the phone is now cleaned
Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


On execution, Singlejump.A replaces built in and third party applications with component that causes device to reboot when executed.

It also uses a Cabir variant that is modified so that instead of sending a copy of itself, the worm loads a specified SIS file (which is installed by Singlejump.A to a location where Cabir expects to find its own file) and starts sending it. In this case, the specified file is a copy of Trojan:SymbOS/Bootton.A.

The modified Cabir worm that Singlejump.A uses is based on Cabir.B and maintains the same replication flaw; thus, it is only capable of sending SymbOS/Bootton.A to the first phone it finds after reboot.

This trojan contains this message:

 Saying HELLO From Here (SYRIA)
TO All The WORLD !!!
I Wish U N-Joy UR
 Damaged Device ..
U Know, Not all may Read These Words But,
 No Problem Bcuz Some will,
 But even This, Thats The Way I Love U All ...