this is a exploit kit:
he will click your malicious link and your trojan will automaticly download and run or you can use a browser exploit.
if you have his email it is easier to send doc exploit with trojan inside to infect him it all depends on your budget