You can also put it through sandboxes like joesandbox or cuckoo to try to trigger and detect a payload. But some malware will expect this and not execute.
Ultimately, judge your own risk tolerance by how much you trust the source, how much you want the software, what kind of systems protection you have in place (antivirus, antimalware, permissions control, backups), and how much you can afford to have your system compromised.