Windows Authenticode signed attribute verification

Hello, I am trying to implement digital signature verification of PE files without using WinVerifyTrust.
When I check the signed attributes (AuthenticatedAttributes) field, I get a different hash than the decoded signature field (encryptedDigest).
What am I doing wrong?

Decoded signature: 0001ff..ff003031300d06096086480165030402010500042066cea53b15089957fc4ca86e419e2058f562e17a802e23e7d5 154d2e71412e1a
sha256 signed attributes: a6586da80afffdde75d9cdf0ef3a91edd741368d20a537fba8c06a5abbf8f85a

Authencode signature: https://lapo.it/asn1js/#MIIGRgYJKoZI...spfAB0nxhR6s9w