Just use an online scanner with many AV engines or use a program like i used to run for years SecureAPlus which is a good whitelisting program that has an easy way to upload and scan using many AV engines. If many AV engines are used to scan a file and it's only reported as potentially malicious by 1-3 AV engines, then it's a false flag 99% of the time.
And since the OG poster said he checked the SHA256 hash signature, which you should do if you think it's malicious and the result matches you really are fine.
