I just want to correct that actually; the hashes, name, size, etc would be fine as long as it's not the actual file or malicious in any way. The issue would be if anything hosted is or contains malicious code, such as some signatures which could contain parts of the original malware. The only concern I have is you wouldn't be able to have a "submit a file for analysis" link unless it sent the malware directly to you, as it could not be saved on the server in any form. That would severely limit the capabilities of the website, especially with the sheer number of malicious files present and possible (hashes in particular could be ruined by simply adding a space to any one of the lines of code - it's literally possible to end up with hundreds of hashes for the same file just because someone added whitespace).