hxxp://taking.no-ip.biz/ogenew/server/ has a binary that might be related.
If you see something like that always grab a copy, it won't be online forever. Shouldn't assume others have it.
I just tried to look. Seems offline.
Was it this?
main_doc.zip > main_doc.exe
https://malwr.com/analysis/ODcwY2FlYmZi ... RjNjlhNmU/
http://4.bp.blogspot.com/-2tkHIwUvvws/U ... ng_bin.png