Turns out I was wrong. I extracted it myself with Resource Hacker, and another extractor. Both resulted in the same GIF, so it looks like it's just stored like that. I'm still fairly sure that it's doing some sort of palette manipulation at runtime, but now I'm less certain about the specifics.

Is the resource stored as a .gif, or is that a byproduct of the extraction? Either way, I'm going out on a limb: based on the filename "FACEDIB", it could be a format I haven't seen since the 2000s: https://docs.fileformat.com/image/dib/ The 256 color mode is indexed color. After seraching around a ...