The problem is that you're printing out the image directly to the output stream, without a "Content-type" prefix.

The Content-type prefix is needed so the browser knows what it's dealing with, and webservers get annoyed if a CGI script doesn't output them correctly :)

Adapted from the GD::Graph docs:

use CGI qw(:standard);
  #...
  print header("image/png");
  binmode STDOUT;
  print $im->png;
[download]

I think that will probably do it.
--
Mike

(Edit: Clarified what Content-type means)