The game is distributed as an archive accompanied by an executable unpacker. The unpacker is signed by GOG, and it can verify the hash of the archive, meaning no malware concern.