In fact the url are actually pointing to http://{blocked}.info/who.jpg/index.html (and the like) and the following file will attempt to download:

 # index2.php - HTML_SOHANAD.AL
 # YMworm.exe - WORM_SOHANAD.AL
 # worm2007.exe - WORM_SOHANAD.AG

From Trend Micro