An Amavis plugin for checking known bad file hashes from Open Threat Exchange.
Add it to Amavis in the @av_scanners array:
['AmavisOTX',
'/usr/local/bin/AmavisOTX',
'{}',
qr/^OK/m,
qr/^Found (hash .*) from (?:https:\/\/.*) in (?:.*)$/m,
qr/^Found (hash .*) from (?:https:\/\/.*) in (?:.*)$/m,
],