Signature Lookup API
AMWScan\Signatures provides read-only lookups over embedded signature indexes. Use it for enrichment or triage. Use Scanner when you need filesystem traversal, pattern matching, reporting, or remediation.
use AMWScan\Signatures;
$match = Signatures::findKnownMalwareHash('sha256', $sha256);
if ($match !== null) {
printf("%s: %s\n", $match['severity'], $match['description']);
}
Known malware SHA-256
| Method | Input | Return |
|---|---|---|
findKnownMalwareHash(string $algorithm, string $hash) | The algorithm sha256 and a 64-character hexadecimal SHA-256 hash | Match record or null |
getKnownMalwareSha256() | None | Array of embedded SHA-256 hashes |
getKnownMalwareIndexSha256() | None | SHA-256 checksum of the embedded source index |
getKnownMalwareMd5PrefixCount() | None | Number of fixed-width MD5-prefix records |
matchesKnownMalwareMd5(string $md5) | A 32-character hexadecimal MD5 | true when its eight-character prefix appears in the index |
findKnownMalwareHash() validates both arguments. It returns null for an unsupported algorithm, malformed hash, or no exact match. A positive match record has id, algorithm, hash, severity, and description keys.
An MD5-prefix match is a candidate signal, not a full-file exact match. Keep it separate from exact SHA-256 matches in alerts and review the file before remediating it.
Legacy core normalization
| Method | Input | Return |
|---|---|---|
normalizedFileSha256(string $path) | Existing regular file that is not a symbolic link | Normalized SHA-256 string or null |
matchesLegacyCoreSha256(string $sha256) | A 64-character hexadecimal SHA-256 | bool |
matchesLegacyCoreFile(string $path) | Existing regular file that is not a symbolic link | bool |
getLegacyCoreSha256Count() | None | Number of legacy-core records |
getLegacyCoreIndexSha256() | None | SHA-256 checksum of the legacy-core source index |
normalizedFileSha256() removes spaces, tabs, carriage returns, and line feeds while hashing. This supports legacy-core matching; it does not produce the same value as hash_file('sha256', $path) for formatted source files.
Domain indicators
getDomainIndicators() returns records with id, domain, classification, and severity. The built-in records use classification: suspicious and severity: warn.
foreach (Signatures::getDomainIndicators() as $indicator) {
if ($indicator['domain'] === $domain) {
// Record a warning-level enrichment signal.
}
}
A suspicious-domain indicator needs context. Domains can be reassigned, remediated, or referenced in archived content. Do not block traffic or alter files from this signal alone.
Internal definition data
Signatures::$raw, Signatures::$regex, Signatures::$domains, getAll(), and optimizeSignatures() power scanner detection. They are not an extension contract. In particular, optimizeSignatures() mutates its by-reference argument. Avoid modifying definition arrays in an application process; use scanner configuration and report review instead.