For PE files the signature lives in a WIN_CERTIFICATE structure referenced by the security directory; the signed hash (the Authenticode digest) skips the checksum field, the security directory entry and the signature itself. signtool sign /fd SHA256 /tr followed by a timestamp server URL and /td SHA256 signs, and signtool verify /pa or PowerShell's Get-AuthenticodeSignature verifies. Multiple signatures can be nested (dual SHA-1 and SHA-256 for old systems).
Windows SmartScreen builds reputation per certificate and file; kernel-mode drivers additionally need Microsoft's attestation or WHQL signing. The 2013 discovery that unauthenticated data could be appended to signed files without breaking the signature (MS13-098, 2013) led to an optional stricter check. The Authenticode inspector parses signatures and timestamps locally.