How can I find the default (font) resource XTerm is using?

The appres utility lists the resources used by an application, both user and default.

appres XTerm xterm

The first argument is the class name (xterm -class Xxx). The second argument, which is optional, is the instance name (xterm -name xxx).

The “Large” font is .VT100.font5 or .VT100.utf8Fonts.font5. See the manual for whether .utf8Fonts is used, it's a bit complex. If you have more than one among *.VT100.font5 and ?.VT100.font5 and XTerm.VT100.font5 and xterm.VT100.font5, the last one in this list applies; see the X documentation for the gory details of resource name precedence.

appres XTerm | grep font5

You can use lsof to list all files by given process id and grep for fonts.

lsof  -p <process_id_of_xterm> | grep fonts

for example,

lsof -p `ps -a | grep xterm | cut -d' ' -f1` | grep fonts

sample output:

$ lsof -p `ps -a | grep xterm | cut -d' ' -f1` | grep fonts
xterm   17560 testuser  mem    REG  253,1    137272  9154732 /usr/share/fonts/liberation/LiberationSans-Bold.ttf
xterm   17560 testuser  mem    REG  253,1    139628  9154735 /usr/share/fonts/liberation/LiberationSans-Regular.ttf

• For fonts: xterm -report-fonts.
• For colours: xterm -report-colors.