I went to XDA to check, and it looks like you already made a post in that device’s questions forum, but didn’t check the ROMs forum? I see a bunch of posts: xdaforums.com/…/samsung-galaxy-j3-2017-roms-kerne…
I’ve never seen builds on XDA that have malware bundled, but they usually have the build sources posted so you can check and build it yourself if you’re so motivated.