I ran stegdetect on the image. According to the manual, it
Tests if information has been embedded with jsteg.
Tests if information has been embedded with outguess.
Tests if information has been embedded with jphide.
Tests if information has been hidden with invisible secrets.
Tests if information has been hidden with F5.
Tests if information has been added at the end of file, for example by camouflage or appendX.
Here is the output.
Code:
austin[50950] carbon /tmp
$ stegdetect -s 10 clue1.jpg
clue1.jpg : jphide(***)
austin[50952] carbon /tmp
$ stegbreak -t p clue1.jpg
Loaded 1 files...
clue1.jpg : negative
Processed 1 files, found 0 embeddings.
Time: 5203 seconds: Cracks: 11266645, 2165.4 c/s
I can verify what EricH said. It looks like there is something hidden inside it with jphide. stegbreak is another command that tries to brute force the password inside the file. I ran that for an hour and a half, and it couldn't find anything. It uses a dictionary attack similar to the one that powers John the Ripper.
Running strings on it didn't yield anything useful other than the XML and some other random looking strings.