prg/wsnpoem url "extraction"
does anyone know the exact algorithm to get the config file's url in prg/wnspoem? the md5 for a sample: 04f21bd0c56dfa7162bd172395186809 (I've uploaded it here). I read www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf but can't just get that url from offset 40 in file.
(hope it's clear my question; my English just sucks :-| )