He uploaded the .exe of his malware to the malware checker sites (like virustotal) and then posted the hashes. You can look up the hashes on virus total and then get the executable.