This link was posted on another thread. When I resubmitted the file to VirusTotal while posting the domain on SiteAdvisor, the analysis was somewhat different, so it may have been changed.
www.222online.cn/down/1003.exe

http://www.virustotal.com/analisis/a5148ac5983a3abe8c9bc9efb163dc1f
Antivirus Version Last Update Result
AhnLab-V3 2008.5.3.0 2008.05.08 -
AntiVir 7.8.0.14 2008.05.08 TR/BHO.Gen
Authentium 4.93.8 2008.05.08 -
Avast 4.8.1169.0 2008.05.07 Win32:Ejik-B
AVG 7.5.0.516 2008.05.07 -
BitDefender 7.2 2008.05.08 -
CAT-QuickHeal 9.50 2008.05.08 (Suspicious) - DNAScan
ClamAV 0.92.1 2008.05.08 -
DrWeb 4.44.0.09170 2008.05.08 Trojan.Click.origin
eSafe 7.0.15.0 2008.05.07 -
eTrust-Vet 31.4.5769 2008.05.08 -
Ewido 4.0 2008.05.08 -
F-Prot 4.4.2.54 2008.05.07 -
F-Secure 6.70.13260.0 2008.05.08 Suspicious:W32/Malware!Gemini
Fortinet 3.14.0.0 2008.05.08 -
Ikarus T3.1.1.26.0 2008.05.08 -
Kaspersky 7.0.0.125 2008.05.08 -
McAfee 5290 2008.05.07 -
Microsoft 1.3408 2008.05.08 Trojan:Win32/Ejik.A
NOD32v2 3086 2008.05.08 -
Norman 5.80.02 2008.05.08 -
Panda 9.0.0.4 2008.05.07 Suspicious file
Prevx1 V2 2008.05.09 Malicious Software
Rising 20.43.32.00 2008.05.08 -
Sophos 4.29.0 2008.05.08 -
Sunbelt 3.0.1097.0 2008.05.07 VIPRE.Suspicious
Symantec 10 2008.05.08 -
TheHacker 6.2.92.305 2008.05.08 -
VBA32 3.12.6.5 2008.05.08 -
VirusBuster 4.3.26:9 2008.05.08 -
Webwasher-Gateway 6.6.2 2008.05.08 Trojan.BHO.Gen
Additional information
File size: 295682 bytes
MD5...: be516f4eda81f33543acbf6a4f1e4644
SHA1..: a1978941511141aca316228c55c6290215585872
SHA256: add81abb87d95c2344e79549c3e99e124525ac7245267e1b7b15320475a1fad9
SHA512: 5b1ebdad15982c92191ef08aec45ae930ec8e454b3a5b065d003934897948575
308b1fe8abcc54365aa28125d5a66f9a6306db70dafb5f462a03008c91e0f429

I've added the file to the malware listserv.

/p1087379-MD5_be516f4eda81f33543acbf6a4f1e4644_1003_exe.html