I think you're talking about PE (executable) files. The VersionInfo is stored as a Resource. The digital signature is stored in a different (previously unused) fork in the PE file. If you look at the most primitive header-dump of a PE file, you'll see a table of pointers that includes a slot for the actual code, import/export table, resource, fixups, etc. The signature is one of those.