Is there a resource online or some API I can use?
I would suggest that if you want a good result, you can subscribe to VirusTotal. But there's a lot of alternatives to VirusTotal:
Lastly does the AV need to hash all legitimate files on the system
when scanning ...
I would suggest rethinking your approach.
Hashes are not virus signatures; they only serve as a fingerprint to identify files. With most conventional hash algorithms (e.g. SHA256), modifying the input slightly results in an entirely different hash output. Thus there is no correlation between malicious features in your virus files and their hashes. ...