Play with online tools like these ones:
https://geekflare.com/php-security-scanner/
Otherwise just upload it to your site and there are lots of scanners that can check your site for malware.
I'll add one last bit, most online scanners can only scan your public files. I use a combination of a local software scanner (on my dev machine which uses isolated containers) and a hosted scanning tool that is on my staging server. Both of these have access to all the files and can find backdoor code and any maliciously uploaded hacks.