The fake resume idea is brilliant. How could I have overlooked that back in the days. All I did as a script kiddie was scanning IP ranges and playing with infected accounts. Good times.
You can add the contents of the .exe to the JPG but when the computer opens it then it isn't going to try and execute the code (it will try and render it as a graphic and probably fail) unless there is some unpatched exploit in the image viewer.
It would create a .exe file that was a simple image viewer and give it the standard .jpg icon. You would name it something like picture003.jpg.exe and most people's computer would conveniently hide the true file extension.
