NAME
====
  Doomjuice.A
        + WORM_DOOMJUICE.A (TrendMicro)
        + W32.HLLW.Doomjuice (Symantec)


EXPERIMENTAL TYPE
=================
  Retrieval Behavior - includes retrieval packets only.


EXPERIMENTAL ENVIRONMENT
========================

   131.113.1.1                  131.113.1.2
  +-----------+                +-----+-----+
  | Infected  |                | Targeted  |
  |    PC     |                |    PC     |
  |  (*1)(*2) |                |           |
  +-----+-----+                +-----+-----+
        |                            |
  ------+----------------------------+------
  131.113.1.0/31

  (*1) Windows XP on VMware
  (*2) Default Route = 131.113.1.2


PCAP SUMMARY
============

Total: 50889  START: 1 0.000000
-----------------
3127/TCP;: 18746
  1 0.000000 131.113.1.1 198.236.202.1 TCP 1036 > 3127 [SYN] Seq=0 Ack=0 Win=16384 Len=0 MSS=1460