There are 2 file types use the .WLU file extension:
1. Jaff Ransomware Encrypted File
A WLU file is a file encrypted by Jaff ransomware, a computer infection utilized by cybercriminals. It contains a user's file, such as a .ACCDB, .ODS, .PPTX, or .WMV file, encrypted with the RSA algorithm and AES-128 ciphers. WLU files became prevalent in 2017.
The WLU file is used by a variant of the Jaff ransomware. The purpose of the virus is to take your files hostage and force you to pay the perpetrator (by way of bitcoin) to unlock your files. The virus is primarily distributed through emails masking as invoices with a malicious .PDF attachment. If you open the attachment, you will encounter a prompt to open an embedded .DOCM file, which downloads the Jaff ransomware and executes it. Once the virus affects your computer it begins scrambling your files, renaming them, and encrypting them. It appends the WLU extension on to the file extension. For example, your example.pub file becomes example.pub.wlu. The virus then generates a README_TO_DECRYPT .TXT, .BMP, and .HTML ransom note files informing you of the takeover and what you need to do to decrypt your files.
There is no program currently available to effectively decrypt your files. If you backup your files you can execute a full system restore. Otherwise, the only known way to decrypt your infected files is to pay the perpetrator for the private key and decrypt program.
Updated: August 7, 2017
2. Windows Legacy Update
A WLU file is an unofficial update file used to update the Windows 2000, Windows XP, or Windows Millennium Edition operating systems. It contains one or more updates for Windows applications and files. WLU files and their installer, WLUpdator, are available for download at Windows Legacy Update's website (win2k.org/wlu/wlu.htm).
Windows Legacy Update is a third-party website that offers unofficial updates to legacy versions of Windows, such as Windows 2000 and Windows XP. These update packages, which are saved within WLU files, allow legacy Windows users to patch old Windows applications and install additional OS-level files (such as font packs and plug-ins).
WLU files are similar to .CAB, .MSI, and .MSU files. However, because WLU files are packed using the outdated IExpress software packer, Windows typically identifies them as malware. As such, you cannot install a WLU file using the Microsoft System Configuration Utility or Microsoft Windows Update. Instead, you must download and use WLUpdator, a .VBE file created by developer Black Wing Cat, to install WLU files.
To install the unofficial Windows update included in a WLU file, you must first download and decompress WLUpdator. Then, you must drag your WLU file to wlupdate.vbe, which will begin the Windows update process.
Updated: June 14, 2020