Determining Where Failure Occurs
If your system fails to shut down, and the last text you see tells you that it is trying to unload a particular kernel module (or perform any other particular task), and there is no indication to the right of it, on the same line, that it succeeded or failed, then the problem is almost certainly with that specific action, and not with whatever comes next. In this situation, you can report a bug documenting the failure of the kernel module to unload.
Reporting a Bug Affecting a Kernel Module
If you have a bug that is due kernel modules provided by a particular, non-kernel package, you can report the bug against that package. If there is actually a kernel service running (ps ax shows kernel threads as well as normal processes) for the module, which you believe is causing the problem, then you can run ubuntu-bug with its PID if you can run ubuntu-bug at all.
Since you likely cannot run any commands in this situation, and since there is often no running process that is clearly responsible, after rebooting, you should instead run:
ubuntu-bug packagename
Here, that's somewhat difficult--the VirtualBox userspace program is provided by virtualbox. VirtualBox kernel modules for virtualization hosts are typically built from source, which is provided by virtualbox-dkms.
I would report this bug against virtualbox-dkms (assuming VirtualBox compiled and installed kernel modules on your machine). The technical details of the bug would likely indicate what package is best, and it is not always practical to determine what package a bug is best considered to affect, before reporting the bug. So you do your best. It can always be changed later on Launchpad, either by you or by someone else (usually a triager or developer).
If you wanted to report a bug against a kernel module that ships with the kernel, you could report it against linux:
ubuntu-bug linux
Best Answer
Apport decided that the attachments/logs/etc you submitted automatically in that bug report may contain information that compromises your privacy.
In time (usually within a few hours, certainly with a few days) then an automatic process will look through your bug report attachments, "retrace" them (which I believe both helps the developers find useful information, but also can remove personal information) and finally marks the bug as public.