As a first and cursory check, you should use a checksum validation tool (like checksum.exe) to validate the checksum (MD 5 hash) of the file. If it doesn't match, you likely need to re-download the files and make sure all is squared away.
When you try to transfer the file over the CUCM via SFTP, does it show the available files and you then specify the new file and it errors while loading the file? If so, at one point does that process fail. Does the file ever successfully download via SFTP?
If you're past that point and actually into the install phase, at one point does the install file? You could also pull the install logs using RTMT and that would be good to take a look at.