It's not just perl; the screen capture code apparently references GWorlds, something I frankly have not seen since writing software in the 1990's for pre OS X A

It's not just perl; the screen capture code apparently references GWorlds, something I frankly have not seen since writing software in the 1990's for pre OS X APIs. It's so old that Googling for gworld hardly has any relevant results. Most of the sample code for those APIs was deprecated by the mid 2000's Unless the attacker had some unique reason for using that, which seems unlikely, that really does put the code at about 10 years old or so...