You don't need to fit everything in 383KB: the initial vector claimed was a USB key so there's no reason that specific exploits couldn't be selected from a larger collection.

For that matter, since this thing is claimed to be on the visibly network there's also no reason why additional code couldn't be downloaded — the sound part is claimed as a slow covert channel for an already infected system.