Work through this in order
- Keep the ZIP archive closed and check its signature
- Read the central-directory listing
- Look for unusual extensions or unexpected paths
- Avoid executing files from untrusted archives
- Extract only with trusted software into a controlled folder
Use the matching tool
Inspect a local copy with ZIP Contents Viewer. After the check, save or repair files only using trusted software that supports the format.