PoorWeb is a multifunction C++ remote-access Trojan widely used by APT37. It is commonly delivered through malicious HWP documents and gives operators remote file-manipulation capabilities. A variant used in Operation Imitation Game tested a decoy address before resolving its real command-and-control server, which could help probe the execution environment and conceal infrastructure.