It seems more reliable to check the developer signature in Properties on the EXE - the correct developer is "Ivaylo Beltchev". The infected download is unsigned and requires you to click through a warning.
So if they were gonna put effort into making an sha1 collision, they'd probably target the signed payload, not the overall exe.
Though it doesn't look like sha1 is that broken yet, for the budget of this grade of attacker.