https://virustotal.com/

Of course those scanners can be wrong. But I guess it's better than some stranger on the internet.

Does rooted Android have some kind of (extra) sandboxing or VM app?

If so, that's the way. It may have a virus, but it'd be stuck in its box.

Otherwise, there's no way to be sure.