It's rather hard to truly hack into a phone, especially remotely. Android is designed so that the user has to approve an app installation for an infection to take hold. I.e. Many malware providers try to trick you into thinking you're infected with a browser popup, and only their antivirus app (which is actually the virus itself) can fix it. You download their app and approve the installation, and now you're really infected.
One thing you could maybe try is doing a Google search of the the malware name Avast is showing in its results, then see if it even makes sense compared to your photo file. If you know that you got the file from a trusted source (I.e. You took the photo, downloaded it from FB. Etc), then it's most likely a false positive.