WinSCP loads version.dll from its own folder because Windows follows a deterministic DLL search order that begins with the application directory (AppDir). Researchers published a detailed analysis showing how to detect this vector through static import table review, Known DLLs filtering, and dynamic tracing with Procmon.
The technique mirrors a recent campaign that distributed a trojanized FileZilla build through the fake domain filezilla-project.live, again abusing version.dll. The same actors later compromised the CPUID supply chain (CPU-Z and HWMonitor) using cryptbase.dll.
DLL Search Order and Known DLLs
Windows checks AppDir first, then System32/SysWOW64, and finally PATH. Known DLLs registered under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs are loaded exclusively from the system directory, bypassing AppDir entirely. version.dll is absent from this list, leaving it vulnerable to sideloading when placed next to WinSCP.exe.
Static analysis with PE-Bear and the lief Python library revealed that WinSCP.exe directly imports only three functions from version.dll: GetFileVersionInfoSizeW, GetFileVersionInfoW, and VerQueryValueW. This small surface makes proxy implementation straightforward.
Proof-of-Concept Implementation
The Rust cdylib proxy exports all 17 functions of the original library. Fourteen are forwarded at link time via a generated proxy.def file that points to C:\Windows\SysWOW64\version.dll for x86 builds. The three hijacked functions are implemented in Rust and trigger a MessageBoxW payload from a separate thread upon first invocation.
Because WinSCP calls these functions during early initialization, the payload executes before the main application window appears. The real system DLL is loaded lazily only when the forwarded functions are first called, preserving compatibility.
The build script (build.rs) dynamically creates the .def file based on CARGO_CFG_TARGET_ARCH, ensuring correct paths for both 32-bit and 64-bit targets. Release builds enable LTO, symbol stripping, and panic=abort for minimal footprint.
