I think you are right. All files are different. The link in #329 leads to file which has been checked by virustotal:

This post requires you to click the "LIKE this post" button and hit F5 to read this content.

Its probably the best to take this.
The file from BEAN is different, has different signing date (later) and has not been checked by virustotal:

This post requires you to click the "LIKE this post" button and hit F5 to read this content.