I know of some images that are available at The Pirate Bay, but they are only for VMware and also require some kind of patch to the virtualisation software for a reason I do not know.
"VMware" is the company, not the product. You can run many versions of OS X as a guest on VMware Fusion and VMware ESXi when the "physical system is an Apple-labeled computer." [1] Installation does not require a hacked ISO or other modified installer however the current ESXi instructions do say to install Mountain Lion first in the VM then install Yosemite on top of it.
I don't know what VMware's software does or doesn't do but its documentation just reiterates what OS X's EULA says. VirtualBox's documentation does the same thing [1] and goes further to caution "These license restrictions are also enforced on a technical level. Mac OS X verifies whether it is running on Apple hardware, and most DVDs that that come with Apple hardware even check for an exact model. These restrictions are not circumvented by VirtualBox and continue to apply."
BTW, if you're going to count on Oracle (who owns VirtualBox) for supporting software freedom, you're going to have a bad time.
> VMware plays fiddle to apple's artificially restrictive licencing
VMware merely passes relevant host information to the guest.
For OS X this is something (can't remember) that satisfies the "Dont Steal Mac OS X" kext. For Windows and PCs with embedded license signature keys (again, can't remember the name, SLIC or something like that) then they're passing that (making virtualized Windows+Office OEM licenses activate against the original hardware†). VirtualBox does not (or did not last time I had to patch it), and it's a pain, putting you in all sorts of legal grey areas for something the license allows.
Summary: important system binaries (such as Finder.app) are encrypted with a key held in the SMC. The OS transparently decrypts them, but needs access to that key to do so.
It is possible to convince QEMU to run OS X: http://www.contrib.andrew.cmu.edu/~somlo/OSXKVM/ (though I've not tried this myself). They do require you to provide the relevant key yourself, I imagine for legal reasons.
You can also use FakeSMC, which is a kext that emulates a real SMC and therefore allows you to bypass that limitation. It's a mandatory requirement for Hackintosh installations.