It's a substitution operator. It is telling perl to find every occurrence of "%" in $box, and replace it with "%%".

See perlrequick and perlre for information on how regular expressions and substitutions work. You will find additional info in perlop under the m// and s/// operators.