It took my friend and me a long time to track this down to WinSCP, but now I'm sure about it. I verified it on another computer with the same file, and the result is the same.
WinSCP version: 4.0.6 build 358
Transfer protocol: both with SFTP and SCP
There is no error message. Everything seems normal, but the file on the server is different from the file on the client.
The file in question can be downloaded from here: <invalid hyperlink removed by admin> User: winscp / Password: Qg5j5a8K
It is contained in a ZIP archive. Unpack it and verify that the md5sum is: '8d0b548533aa231652a91f040c99ffe2'
After uploading it to somewhere with WinSCP, it will have the md5sum 'e104794beaf0b830a09dbefa04a861f9'.
I consider this bug to be highly critical.
If you need more information, please contact me by mail.