How to test a nulled WP theme?

So we all know that nothing is free, there can be always a trap or trick on "free" codes, apps or any illegal content.
I used so nulled WP themes and some of them have malicious codes that spread like a virus. For example, some injected codes create some php files and copy themselves to other domains on a shared hosting.
So, how to inspect and examine nulled WP themes?
Is there a way or plugin to make a security check for malicious codes?

- get a free wp hosting, set it up and upload the nulled theme
- a virtual machine like oracle, you can set WP platform there and test the theme
- I guess there are more ways you can test without risking your actual site and content
- user virustotal dot com

This link will give a glimpse of instruction for checking malware in your Wordpress theme and plugins.
https://secure.wphackedhelp.com/blog/detect-malicious-code-malware-wordpress-themes-plugins

Thank you for your input.
I found these tools too:
https://webshell.co
https://www.shelldetector.com