diff --git a/BurnOutSharp.Models/PortableExecutable/AttributeCertificateTableEntry.cs b/BurnOutSharp.Models/PortableExecutable/AttributeCertificateTableEntry.cs
new file mode 100644
index 00000000..d6c384e0
--- /dev/null
+++ b/BurnOutSharp.Models/PortableExecutable/AttributeCertificateTableEntry.cs
@@ -0,0 +1,63 @@
+namespace BurnOutSharp.Models.PortableExecutable
+{
+ ///
+ /// Attribute certificates can be associated with an image by adding an attribute
+ /// certificate table. The attribute certificate table is composed of a set of
+ /// contiguous, quadword-aligned attribute certificate entries. Zero padding is
+ /// inserted between the original end of the file and the beginning of the attribute
+ /// certificate table to achieve this alignment.
+ ///
+ /// The virtual address value from the Certificate Table entry in the Optional
+ /// Header Data Directory is a file offset to the first attribute certificate
+ /// entry. Subsequent entries are accessed by advancing that entry's dwLength
+ /// bytes, rounded up to an 8-byte multiple, from the start of the current
+ /// attribute certificate entry. This continues until the sum of the rounded dwLength
+ /// values equals the Size value from the Certificates Table entry in the Optional
+ /// Header Data Directory. If the sum of the rounded dwLength values does not equal
+ /// the Size value, then either the attribute certificate table or the Size field
+ /// is corrupted.
+ ///
+ /// The first certificate starts at offset 0x5000 from the start of the file on disk.
+ /// To advance through all the attribute certificate entries:
+ ///
+ /// 1. Add the first attribute certificate's dwLength value to the starting offset.
+ /// 2. Round the value from step 1 up to the nearest 8-byte multiple to find the offset
+ /// of the second attribute certificate entry.
+ /// 3. Add the offset value from step 2 to the second attribute certificate entry's
+ /// dwLength value and round up to the nearest 8-byte multiple to determine the offset
+ /// of the third attribute certificate entry.
+ /// 4. Repeat step 3 for each successive certificate until the calculated offset equals
+ /// 0x6000 (0x5000 start + 0x1000 total size), which indicates that you've walked
+ /// the entire table.
+ ///
+ /// Attribute certificate table entries can contain any certificate type, as long as
+ /// the entry has the correct dwLength value, a unique wRevision value, and a unique
+ /// wCertificateType value. The most common type of certificate table entry is a
+ /// WIN_CERTIFICATE structure, which is documented in Wintrust.h and discussed in
+ /// the remainder of this section.
+ ///
+ ///
+ public class AttributeCertificateTableEntry
+ {
+ ///
+ /// Specifies the length of the attribute certificate entry.
+ ///
+ public uint Length;
+
+ ///
+ /// Contains the certificate version number.
+ ///
+ public WindowsCertificateRevision Revision;
+
+ ///
+ /// Specifies the type of content in Certificate.
+ ///
+ public WindowsCertificateType CertificateType;
+
+ ///
+ /// Contains a certificate, such as an Authenticode signature.
+ ///
+ ///
+ public byte[] Certificate;
+ }
+}
diff --git a/BurnOutSharp.Models/PortableExecutable/Executable.cs b/BurnOutSharp.Models/PortableExecutable/Executable.cs
index 70cc16e1..89794959 100644
--- a/BurnOutSharp.Models/PortableExecutable/Executable.cs
+++ b/BurnOutSharp.Models/PortableExecutable/Executable.cs
@@ -46,6 +46,11 @@ namespace BurnOutSharp.Models.PortableExecutable
///
public COFFStringTable COFFStringTable { get; set; }
- // TODO: Left off at "The Attribute Certificate Table (Image Only)"
+ ///
+ /// Attribute certificate table
+ ///
+ public AttributeCertificateTableEntry[] AttributeCertificateTable { get; set; }
+
+ // TODO: Left off at "Delay-Load Import Tables (Image Only)"
}
}