Hi!
It all depends on the malicious content you are talking about, if it is a script, shellcode, bytes, etc. With the content type in mind, you can do a google search about how to embed certain type of data to an image.

Greetings!
Diego