I made an experimental AV application to detect some test files as malware. It uses a simple signature based detection to detect those files. When my test AV encounters a file, it computes the SHA256 hash of that file, and then compares it with a database of hashes that are "deemed" malware. It will then either quarantine or delete that detected file... I realized that this method was very naive and will never offer any protection against zero day attacks or detect viruses whose hashes are not in the database. Also, professional AV software use sandboxing and API hooking to detect suspicious activity of executables. But consider this hypothetical case:
If I have the MD5 or SHA256 hashes of all known viruses till date in this world, will using only signature based detection give protection to my user.
In this age of self replicating viruses is signature based malware detection still used by Anti malware software to detect computer viruses or does it have some other applications when dealing with malware? What if the OS in which an Antivirus Software runs on does not give permission for API hooking or the system does not have enough resources (RAM) for sandboxing, then will signature based detection have some application ?